ML22034A621: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
 
Line 19: Line 19:


=Text=
=Text=
{{#Wiki_filter:INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion                                        Title                                                                  Page
{{#Wiki_filter:}}
 
==SUMMARY==
DESCRIPTION ................................................................................. 7.1-1 7.1.1      PROCESS INTEGRATED CONTROL SYSTEM ............................... 7.1-1 7.1.2      TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM ............................................................................................. 7.1-2 7.1.3      ENGINEERED SAFETY FEATURES ACTUATION SYSTEM ........... 7.1-3 7.1.4      HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN ............... 7.1-3 7.1.5      CONTROL CONSOLE AND DISPLAYS ............................................ 7.1-4 7.1.6      RADIATION MONITORING................................................................. 7.1-5 7.1.7      NEUTRON FLUX DETECTION SYSTEM .......................................... 7.1-5 DESIGN OF INSTRUMENTATION AND CONTROL SYSTEMS ......................... 7.2-1 7.2.1      SYSTEM DESCRIPTION .................................................................... 7.2-1 7.2.2      DESIGN CRITERIA ............................................................................ 7.2-1 7.2.3      DESIGN BASES ................................................................................. 7.2-2 7.2.4      OPERATION AND PERFORMANCE ................................................. 7.2-2 PROCESS INTEGRATED CONTROL SYSTEM ................................................. 7.3-1 7.3.1      SYSTEM DESCRIPTION .................................................................... 7.3-1 7.3.2      DESIGN CRITERIA .......................................................................... 7.3-32 7.3.3      DESIGN BASIS ................................................................................ 7.3-34 7.3.4      OPERATION AND PERFORMANCE ............................................... 7.3-36 7.
 
==3.5      CONCLUSION==
.................................................................................. 7.3-37 NE Medical Technologies                      7-i                                                                Rev. 2
 
INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion                                    Title                                                                  Page TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM .............. 7.4-1 7.4.1      SYSTEM DESCRIPTION ................................................................... 7.4-1 7.4.2      DESIGN CRITERIA ............................................................................ 7.4-2 7.4.3      DESIGN BASIS ................................................................................ 7.4-19 7.4.4      OPERATION AND PERFORMANCE ............................................... 7.4-30 7.4.5      HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN.............. 7.4-39 7.
 
==4.6      CONCLUSION==
................................................................................... 7.4.60 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM ............................. 7.5-1 7.5.1      SYSTEM DESCRIPTION ................................................................... 7.5-1 7.5.2      DESIGN CRITERIA ............................................................................ 7.5-2 7.5.3      DESIGN BASIS ................................................................................ 7.5-19 7.5.4      OPERATION AND PERFORMANCE ............................................... 7.5-37 7.5.5      HIGHLY INTEGRATED PROTECTION SYSTEM (HIPS) DESIGN .. 7.5-44 7.
 
==5.6      CONCLUSION==
................................................................................... 7.5.44 CONTROL CONSOLE AND DISPLAY INSTRUMENTS ..................................... 7.6-1 7.
 
==6.1      DESCRIPTION==
................................................................................... 7.6-1 7.6.2      DESIGN CRITERIA ............................................................................ 7.6-4 7.6.3      DESIGN BASIS .................................................................................. 7.6-8 7.6.4      OPERATION AND PERFORMANCE ............................................... 7.6-10 7.
 
==6.5      CONCLUSION==
.................................................................................. 7.6-13 NE Medical Technologies                  7-ii                                                                Rev. 2
 
INSTRUMENTATION AND CONTROL SYSTEMS TABLE OF CONTENTS tion                                          Title                                                                  Page RADIATION MONITORING SYSTEMS ............................................................... 7.7-1 7.7.1      SAFETY-RELATED PROCESS RADIATION MONITORING ............ 7.7-1 7.7.2      NONSAFETY-RELATED PROCESS RADIATION MONITORING .... 7.7-7 7.7.3      AREA RADIATION MONITORING ..................................................... 7.7-7 7.7.4      CONTINUOUS AIR MONITORING .................................................... 7.7-9 7.7.5      EFFLUENT MONITORING ............................................................... 7.7-10 7.
 
==7.6      CONCLUSION==
.................................................................................. 7.7-13 NEUTRON FLUX DETECTION SYSTEM ............................................................ 7.8-1 7.8.1      SYSTEM DESCRIPTION ................................................................... 7.8-1 7.8.2      DESIGN CRITERIA ............................................................................ 7.8-1 7.8.3      DESIGN BASES ................................................................................. 7.8-9 7.8.4      OPERATION AND PERFORMANCE ............................................... 7.8-13 7.
 
==8.5      CONCLUSION==
................................................................................... 7.8-14 REFERENCES ..................................................................................................... 7.9-1 NE Medical Technologies                      7-iii                                                                Rev. 2
 
1    Design Radiation Environments 2    Facility Control Room Design Environmental Parameters 3    RPF and IF General Area Design Environmental Parameters 4    IU Cell Interior Design Environmental Parameters 5    TOGS Cell Interior Design Environmental Parameters 6    Primary Cooling Room Interior Design Environmental Parameters 1    TRPS Monitored Variables 1    ESFAS Monitored Variables 2    Fail Safe Component Positions on ESFAS Loss of Power 1    Safety-Related Process Radiation Monitors 2    Radiation Area Monitor Locations 3    Continuous Airborne Monitor Locations NE Medical Technologies                7-iv                      Rev. 0
 
1    Instrumentation and Control System Architecture 2    Target Solution Vessel Reactivity Protection System Architecture 3    Engineered Safety Feature Actuation System Architecture 1    Process Integrated Control System Architecture 1    TRPS Logic Diagrams 2    HIPS Platform Timing 3    TRPS and ESFAS Programmable Logic Lifecycle Process 1    ESFAS Logic Diagrams 1    Facility Control Room Layout 2    Main Control Board Sections 3    Maintenance Workstation 1    Effluent Monitor Locations NE Medical Technologies                7-v                          Rev. 2
 
onym/Abbreviation      Definition ARA                        as low as reasonably achievable S                        American Nuclear Society SI                        American National Standards Institute V                        air operated valve L                        actuation and priority logic AI                        application specific action item 3                        boron trifluoride ST                        built-in self-test AS                        criticality accident alarm system MS                        continuous air monitoring system cubic centimeter F                        common cause failure A                        critical digital asset BEM                      carbon delay bed effluent monitor curie communication modules NE Medical Technologies 7-vi                                    Rev. 2
 
onym/Abbreviation      Definition TS                        commercial off-the-shelf s                          counts per second C                        cyclic redundancy checks B                        calibration and test bus direct current M                          equipment interface module I                        electromagnetic interference FAS                      engineered safety features actuation system T                          factory acceptance test HS                        facility chilled water system R                        facility control room RS                        facility chemical reagent system CS                        facility data and communications system WS                        facility demineralized water system WS                        facility heating water system HS                        facility nitrogen handling system NE Medical Technologies 7-vii                                      Rev. 2
 
onym/Abbreviation      Definition GA                        field programmable gate array Z4                        facility ventilation zone 4 PS                          highly integrated protection system S                          hardware requirements specification I                          human system interfaces AC                        heating, ventilation, and air conditioning PS                        high voltage power supply W-SM                        hardwired submodule WM                          hardwired module C                          instrumentation and control E                          integrated development environment N                          isolated development network EE                          Institute of Electrical and Electronic Engineers irradiation facility G                          interim staff guidance M                          input submodule NE Medical Technologies 7-viii                                        Rev. 2
 
onym/Abbreviation        Definition S                          impurity treatment subsystem irradiation unit P                          iodine and xenon purification PS                        light water pol system i                          microcurie subcritical multiplication factor molybdenum extraction and purification EPS system monitoring and indication communication
-CM module B                          monitoring and indication bus molybdenum isotope product packaging PS system WS                          maintenance workstation PS                        nitrogen purge system AS                        neutron driver assembly system DS                        neutron flux detection system National Institute of Standards and ST Technology NE Medical Technologies 7-ix                                      Rev. 2
 
onym/Abbreviation        Definition SS                        normal electrical power supply system M                          nonvolatile memory OS                          out of service LS                        primary closed loop cooling system CS                          process integrated control system DS                        programmable logic design specification programmable logic requirements RS specification DA                        partial trip determination actuation VS                        process vessel vent system quality assurance PD                        quality assurance program description MS                        radiation area monitoring system A                          radiologically controlled area S                          radioactive drain system I                          radio-frequency interference WI                        radioactive liquid waste immobilization NE Medical Technologies 7-x                                        Rev. 2
 
onym/Abbreviation      Definition WS                        radioactive liquid waste storage CS                        radioisotope process facility cooling system F                          radioisotope production facility Z1                        radiological ventilation zone 1 radiological ventilation zone 1 exhaust Z1e subsystem radiological ventilation zone 1 recirculating Z1r subsystem Z2                        radiological ventilation zone 2 radiological ventilation zone 2 exhaust Z2e subsystem radiological ventilation zone 2 recirculating Z2r subsystem radiological ventilation zone 2 supply Z2s subsystem Z3                        radiological ventilation zone 3 receiver SS                        subcritical assembly support structure M                          scheduling and bypass modules NE Medical Technologies 7-xi                                          Rev. 2
 
onym/Abbreviation      Definition VM                        scheduling, bypass, and voting modules AS                        subcritical assembly system B1                        safety data bus 1 B2                        safety data bus 2 B3                        safety data bus 3 E                        secure development environment M                        safety function module S                        standby generator system V                        solenoid operated valve M                        stack release monitor MS                        stack release monitoring system M                        scheduling and voting module RS                        system requirements specification D                          total integrated dose GS                        TSV off-gas system S                        tritium purification system NE Medical Technologies 7-xii                                    Rev. 2
 
onym/Abbreviation      Definition target solution vessel reactivity protection PS system PS                          target solution preparation system SS                          target solution storage system V                          target solution vessel transmitter SS                          uninterruptible electrical power supply system SS                        uranium receipt and storage system V                          verification & validation C/ITS                      vacuum/impurity treatment subsystem S                          vacuum transfer system NE Medical Technologies 7-xiii                                        Rev. 2
 
==SUMMARY==
DESCRIPTION instrumentation and control (I&C) systems provide the capability to monitor and control the NE facility systems manually and automatically during normal conditions and maintain the lity in a safe condition under accident conditions.
chapter describes the design of the I&C systems, including classification, functional uirements and architecture, and demonstrates the systems capabilities to perform safety and safety-related functions. The scope of the information provided in this chapter includes tems that are safety-related as defined by SHINEs Quality Assurance Program Description nonsafety-related I&C systems that perform specific regulatory required functions.
tion 7.1 provides an introduction and overview of I&C systems, which include safety-related nonsafety-related systems. Systems and topics addressed in this chapter include:
* the process integrated control system (PICS) and vendor-provided nonsafety-related control systems
* the target solution vessel (TSV) reactivity protection system (TRPS)
* the engineered safety feature actuation system (ESFAS)
* the highly integrated protection system (HIPS) underlying TRPS and ESFAS
* facility control room control consoles and displays
* radiation monitoring, including
      - safety-related process radiation monitors considered part of the ESFAS, TRPS, and tritium purification system (TPS)
      - nonsafety-related process radiation monitors included as part of other facility processes
      - the radiation area monitoring system (RAMS)
      - the continuous air monitoring system (CAMS)
      - the stack release monitoring system (SRMS)
* the neutron flux detection system (NFDS) architectural design of I&C systems is based on providing clear interconnection interfaces of lity I&C structures, systems, and components. Each irradiation unit (IU) has an independent ty-related TRPS and NFDS. A single nonsafety-related PICS provides the nonsafety tions of the IUs and facility level nonsafety-related functions. An ESFAS is provided for ty-related functions that are common to the entire facility. The RAMS, CAMS, and SRMS vide their functions at a facility level separate from the irradiation units.
mplified block diagram of the overall I&C system architecture is provided in Figure 7.1-1.
1        PROCESS INTEGRATED CONTROL SYSTEM PICS is a nonsafety-related distributed digital control system that provides monitoring and trol of the various processes throughout the SHINE facility. The PICS includes system trols, both automated and manual, and human system interfaces (HSIs) necessary to provide operator interaction with the necessary process control mechanism. The HSIs provided in the lity control room (FCR) are described in Section 7.6.
NE Medical Technologies                      7.1-1                                      Rev. 2
 
trol and monitoring of the systems and components in the radioisotope production facility F).
functions of the PICS enable the operator to perform irradiation cycles, transfer target tion to and from the IU as well as throughout the RPF, and interface with the TPS, processes e supercell, waste handling operations, and the auxiliary systems.
ddition to the PICS, certain systems contain vendor-provided nonsafety-related control tems which interface with the PICS. These systems consist of the neutron driver assembly tem (NDAS) controls, supercell controls, and various auxiliary system controls.
PICS and other vendor -provided nonsafety-related control systems are further described in tion 7.3.
2        TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM purpose of the TRPS is to monitor process variables and provide automatic initiating signals esponse to off-normal conditions, providing protection against unsafe IU operation during the illing, irradiation, and post-irradiation modes of operation. Each IU has its own TRPS, figured as shown in Figure 7.1-2. The major safety function of the TRPS is to monitor ables associated with the IU and trip the neutron driver and actuate the engineered safety ures when specified setpoints, based on analytical limits, are reached or exceeded.
TRPS maintains the modes of operation of the IU and creates the necessary interlocks and missives on each safety function needed for the different modes. Modes are transitioned uentially using an operator input.
TRPS also transmits status and information signals to the nonsafety-related maintenance kstation (MWS) and to the PICS for display in the FCR, trending, and historian purposes.
TRPS uses the HIPS platform as described in Section 2.0 of NuScale Topical ort TR-1015-18653, Design of Highly Integrated Protection System Platform (NuScale, 7). HIPS is a field programmable gate array (FPGA)-based system. The TRPS incorporates fundamental I&C principles of independence, redundancy, predictability and repeatability, diversity and defense-in-depth as used by the HIPS platform. SHINE relies on the prior NRC roval of the HIPS platform described in the HIPS topical report Safety Evaluation Report R) (USNRC, 2017) to demonstrate the acceptability of the platform for use in the SHINE lity and to partially demonstrate that the design of the TRPS meets SHINE Design Criteria.
TRPS includes the following safety-related (except where noted otherwise) components:
* one division of input modules, signal conditioning, and trip determination
* two divisions of input modules, signal conditioning, trip determination, voting and actuation equipment
* two divisions of power distribution panels
* power supplies for sensors and TRPS components
* two nonsafety-related MWSs (shared with the ESFAS)
* manual input switches NE Medical Technologies                      7.1-2                                        Rev. 2
 
TRPS is further described in Section 7.4.
3        ENGINEERED SAFETY FEATURES ACTUATION SYSTEM purpose of the ESFAS is to monitor process variables and provide automatic initiating als in response to off-normal conditions, providing protection against unsafe conditions in the n production facility. The ESFAS is a plant level control system not specific to any operating or process, configured as shown in Figure 7.1-3. The two major safety functions of the FAS are to provide:
* sense and command functions necessary to maintain the facility confinement strategy and
* process actuation functions as required by the safety analysis.
ESFAS also transmits status and information signals to the nonsafety-related MWS and to PICS for display in the FCR, trending, and historian purposes.
ESFAS, like the TRPS, is also built using the HIPS platform as described in Section 2.0 of cale Topical Report TR-1015-18653, Design of Highly Integrated Protection System form (NuScale, 2017). The ESFAS incorporates the fundamental I&C principles of pendence, redundancy, predictability and repeatability, and diversity and defense-in-depth sed by the HIPS platform. SHINE relies on the prior NRC approval of the HIPS platform cribed in the HIPS topical report Safety Evaluation Report (SER) (USNRC, 2017) to onstrate the acceptability of the platform for use in the SHINE facility and to partially onstrate that the design of the ESFAS meets SHINE Design Criteria.
ESFAS includes the following safety-related components (except where noted otherwise):
* one division of input modules, signal conditioning, and trip determination
* two divisions of input modules, signal conditioning, trip determination, voting and actuation equipment
* two divisions of power distribution panels
* power supplies for sensors and ESFAS components
* two nonsafety-related MWSs (shared with the TRPS)
* manual input switches boundary of the ESFAS extends from the terminations of the cabling at the output of the sors to the terminations of the cabling to each actuation component of the ESFAS.
ESFAS is further described in Section 7.5.
4        HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN HIPS platform is a generic digital safety-related I&C platform devoted to the implementation afety-related applications in nuclear facilities. The platform is a logic-based platform that does utilize software or microprocessors for operation. It is composed of logic implemented using rete components and FPGA technology. The platform is described in detail in Section 2.0 of NE Medical Technologies                      7.1-3                                        Rev. 2
 
5        CONTROL CONSOLE AND DISPLAYS operator workstations and main control board are provided as the HSI subset of components he FCR. These components are included as part of the PICS and are classified as nonsafety-ted.
two operator workstations provide operators with interactive displays to perform daily vities for the SHINE facility. The displays at the operator workstation are capable of being nged to the appropriate screen applicable to the activities that the operator is performing ng day-to-day operations of the SHINE facility. Additional equipment, located between the operator workstations and usable by either operator, is dedicated to controlling the eight AS units located in the IU cells.
main control board, located in front of the two operator workstations, includes both digital lays and limited manual interfaces.
main control board provides the operator with multiple digital displays, configured to tinuously display variables important to safety-related system status for individual IUs and the nce of the SHINE facility. The displays on the main control board are used to support manual ation of safety-related systems and to verify correct operation of the safety-related systems e event of an actuation.
main control board provides operator interfaces for:
* manual actuation of the TRPS and ESFAS protective functions,
* the enable nonsafety function, which allows PICS control of the actuation and priority logic (APL) output state (i.e., deenergized or energized), and
* the facility operating permissive key, which is used to place the main production facility into a secure state.
supervisor workstation is located at the rear of the facility control room and acts as an nsion of the operator workstations. The supervisor workstation is equipped with equipment lay screens that allow the supervisor to monitor system status, but not control facility ponents.
ility controls are designed and located using consideration of human factors engineering ciples. SHINE uses human factors engineering principles to facilitate the safe, efficient, and ble performance of operations, maintenance, tests, inspections, and surveillance tasks, and nsure the implementation of operator interfaces, indicators, and controls are standardized oss vendors.
se systems are further described in Section 7.6.
NE Medical Technologies                      7.1-4                                        Rev. 2
 
iation monitoring is used to monitor radiation levels within the SHINE facility, to provide ms for personnel within the facility and the control room, to provide actuation signals to ty-related control systems, and to monitor airborne effluent streams from the facility.
ety-related process radiation monitoring is performed by ESFAS, TRPS and TPS radiation nitors. These monitors provide input into the safety-related controls to provide input for safety ations and interlocks, and provide indication and alarm signals to the FCR.
safety-related process radiation monitors are used in select facility processes to provide us information and diagnose off-normal process conditions.
a radiation monitoring and local alarms within the general areas of the facility radiologically trolled area (RCA) are provided by the RAMS. This nonsafety-related system also provides als to the FCR to inform operators of abnormal conditions within the facility.
orne contamination monitoring within general areas of the RCA is performed by the CAMS.
CAMS units are nonsafety-related devices that provide local alarms and provide signals to FCR to inform operators of the occurrence and approximate location of abnormal conditions.
mal airborne facility effluents are directed into a single facility stack and are monitored by the k release monitor. An alternate safety-related vent path for the nitrogen purge system is nitored by the carbon delay bed effluent monitor. These nonsafety-related effluent monitors vide control room indication and alarm. The main production facility does not have a normal id effluent path from the RCA, and as such no liquid effluent monitoring system is provided.
se systems are further described in Section 7.7.
7        NEUTRON FLUX DETECTION SYSTEM NFDS is used for monitoring the reactivity and power of the subcritical assembly system in IU. The NFDS is a safety-related system with redundant channels of neutron flux detectors.
NFDS detects and provides remote indication of the neutron flux levels during TSV filling irradiation to determine the multiplication factor and power levels, respectively. The NFDS vides safety-related outputs to the TRPS used for trip determination. The TRPS provides safety-related outputs to the PICS, which are used for monitoring of conditions within the IU.
ee sets of NFDS detectors are provided for each IU, located in the light water pool ounding the subcritical assembly support structure (SASS).
ee NFDS divisions, designated as Division A, Division B, and Division C, serve each IU. The DS divisions are powered from safety-related power feeds, and the equipment associated each NFDS division maintains electrical and physical separation with the other divisions for same IU.
NFDS is further described in Section 7.8.
NE Medical Technologies                      7.1-5                                        Rev. 2
 
Chapter 7 - Instrumentation and Control Systems                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Summary Description Figure 7.1 Instrumentation and Control System Architecture CAMS                          RAMS                          SRMS LEGEND                                                  ACRONYMNS EXTERNAL UNIDIRECTIONAL DATA                      CAMS - CONTINUOUS AIR MONITORING SYSTEM ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM                                              NEUTRON FLUX DETECTION SYSTEM (NFDS)
INTERNAL DIAGNOSTIC AND PARAMETER DATA            NFDS - NEUTRON FLUX DETECTION SYSTEM PICS - PROCESS INTEGRATED CONTROL SYSTEM INTERNAL SAFETY DATA RAMS - RADIATION AREA MONITORING SYSTEM                                                                DIV DIV AANEUTRON NEUTRONFLUX FLUX        DIV DIVAAANEUTRON DIV    NEUTRONFLUX NEUTRON  FLUX FLUX          DIV DIV AA NEUTRON NEUTRON FLUX FLUX EXTERNAL DISCRETE SIGNAL OR DATA                  SRMS - STACK RELEASE MONITORING SYSTEM                                                                DIV  A  NEUTRON DETECTOR DETECTOR DETECTOR DIV    C  NEUTRON DETECTOR DETECTOR DETECTOR DIV DETECTOR B NEUTRON DETECTOR TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM                                            FLUX DETECTOR            X8 FLUX DETECTOR                    FLUX DETECTOR X8                                                            X8 INTERNAL DISCRETE SIGNAL APL - ACTUATION AND PRIORITY LOGIC VENDOR PROVIDED NSR NONSAFETY CONTROL SYSTEM CTB - CALIBRATION AND TEST BUS                                                                                                                                                                                                                                                                                                                                                                                                                                                                              CONTROL SYSTEMS SAFETY CONTROL SYSTEM                            EIM - EQUIPMENT INTERFACE MODULE HWM - HARDWIRED MODULE                                                                                        DIV NFDSA NFDS NFDS                        DIV C NFDS NFDS NFDS                            DIV NFDSB NFDS NFDS HIPS PLATFORM SAFETY FUNCTION MODULE                                                                                                                            DIV DIVAAA DIV                          DIV AA DIV DIV  A                          DIV DIVAAA DIV HW-SM - HARDWIRED-SUBMODULE                                                                                PRE-AMP                      PRE-AMP                        PRE-AMP HIPS PLATFORM COMMUNICATION MODULE                MIB - MONITORING AND INDICATION BUS MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE X8                          X8                              X8 PROCESS INTEGRATED CONTROL SYSTEM HIPS PLATFORM EQUIPMENT INTERFACE MODULE          MWS - MAINTENANCE WORKSTATION HIPS PLATFORM HARDWIRED MODULE RX - RECEIVER SBM - SCHEDULING AND BYPASS MODULE (PICS)
SBVM - SCHEDULING, BYPASS, AND VOTING MODULE                                                                  DIV NFDSA NFDS NFDS                          DIV C NFDS NFDS                            DIV NFDSB NFDS NFDS DIV DIVAAA DIV                          DIV DIV AA                          DIV DIVAAA DIV SDB - SAFETY DATA BUS                                                                                    PROCESSING                  PROCESSING                      PROCESSING SFM - SAFETY FUNCTION MODULE                                                                            X8                          X8                              X8 TX - TRANSMITTER SAFETY-RELATED                                                                                                                                                                                                                                                                                                                                                    SAFETY-RELATED INSTRUMENTATION                                                                                                                                                                                                                                                                                                                                                  INSTRUMENTATION X8 RX    TX  TX                                                                                                                                                                                                                                                                                                                                                                                  RX  TX        TX SAFETY-RELATED                                                                                          MI-CM                                        SFM                                                                                                                    SAFETY-RELATED                                                                                                  SAFETY-RELATED                                                                                          MI-CM                            SFM                                                                                    SAFETY-RELATED INSTRUMENTATION                                                                                                                                                                                                                                                            INSTRUMENTATION                                                                                                  INSTRUMENTATION                                                                                                                                                                                                                  INSTRUMENTATION MIB        CTB                  CTB    SDB1      SDB2      SDB3 MIB                                                                                                                                                                                                                                                                                                                        MIB      CTB          CTB    SDB1  SDB2    SDB3 MIB IRRADIATION                                                                                                                                                                                                                                                                                                                                                                                    ESFAS DIV C UNIT 1 MWS                                                                                                                                              DIV C                                                                                                        TSV REACTIVITY                                                                                    MWS                                                        MWS ENGINEERED SAFETY                                                                                                                                                                                                                              MWS DIV A                                                                                                                                                                                                                                                                                                                                                            DIV B                                                      DIV A                                                                                                                                                                                                                                                                                                    DIV B SDB      MIB                SDB      MIB                SDB      MIB                        PROTECTION SYSTEM                                                                                                                                                                                                            FEATURE ACTUATION                                                SDB      MIB        SDB    MIB          SDB      MIB X8                                                                                                                                                                SBM1                        SBM2                        SBM3                                                (TRPS)                                                                                                          X8                                                                                                                                                              SBM1                SBM2                  SBM3 TX    RX      TX                                                                                                                                              TX    TX                    TX  TX                    TX      TX                                                                                                                                RX    TX    TX                            TX              TX    RX SYSTEM (ESFAS)                                              TX    TX          TX  TX              TX      TX                                                                                                                TX    RX    TX MI-CM                                          SFM                                                                                                                                                                                                                                                                            SFM                                MI-CM                                      MI-CM                                    SFM                                                                                                                                                                                                                              SFM                                MI-CM MIB          CTB                CTB    SDB3    SDB2  SDB1  MIB                                                                                                                                                                                                                                                  MIB SDB1    SDB2    SDB3    CTB          CTB        MIB                                MIB          CTB          CTB    SDB3    SDB2  SDB1  MIB                                                                                                                                                                                                    MIB  SDB1    SDB2    SDB3    CTB          CTB      MIB IRRADIATION                                                                                      IRRADIATION                                                                                                                                                                                                                                                                                  ESFAS DIV A                                                            ESFAS DIV B UNIT 1                                                                                              UNIT 1 DIV A                                                                                              DIV B SDB1  SDB2      SDB3  MIB                                            SDB  SDB    MIB          SDB    SDB    MIB            SDB  SDB    MIB                                                                                                      MIB  SDB    SDB        MIB  SDB    SDB          MIB  SDB    SDB                                  MIB  SDB3    SDB2  SDB1                          SDB1    SDB2    SDB3  MIB                                    SDB  SDB    MIB        SDB  SDB    MIB        SDB  SDB      MIB                                                                  MIB    SDB  SDB        MIB  SDB  SDB        MIB  SDB  SDB                                    MIB  SDB3  SDB2    SDB1 HARDWIRED MODULE (HWM)                                                                                                                                                                                                                                                                      HARDWIRED MODULE (HWM)                                                                                        HARDWIRED MODULE (HWM)                                                                                                                                                                                                                      HARDWIRED MODULE (HWM)
TRIP/BYPASS                                                                                                                                                                                                                                                                                TRIP/BYPASS                                                                                                  TRIP/BYPASS                                                                                                                                                                                                                                  TRIP/BYPASS APL EIM                FACILITY INPUTS MANUAL INPUTS                  SBVM3                        SBVM2                        SBVM1                                                                                                              SBVM1                    SBVM2                    SBVM3                        FACILITY INPUTS MANUAL INPUTS      EIM                APL EIM          FACILITY INPUTS MANUAL INPUTS                SBVM3                    SBVM2                    SBVM1                                                                              SBVM1                  SBVM2                SBVM3                      FACILITY INPUTS MANUAL INPUTS      EIM POSITION INPUTS          HW-SM    RX  TX  RX HW-SM HW-SM    RX  TX  RX HW-SM HW-SM    RX TX    RX HW-SM HW-SM    RX  RX  TX HW-SM HW-SM  RX RX  TX HW-SM HW-SM  RX  RX  TX HW-SM POSITION INPUTS                                                              APL                            POSITION INPUTS        HW-SM    RX TX  RX HW-SM HW-SM    RX TX  RX HW-SM HW-SM    RX TX    RX HW-SM HW-SM    RX    RX TX HW-SM HW-SM    RX  RX TX HW-SM HW-SM    RX  RX TX HW-SM POSITION INPUTS                    APL TRPS DIV A ACTUATION                                                                                                                                                                                                                                                                                                                                          TRPS DIV B ACTUATION                                    ESFAS DIV A                                                                                                                                                                                                                                                                                        ESFAS DIV B DEVICES                                                                                                                                                                                                                                                                                                                                                      DEVICES                                    ACTUATION DEVICES                                                                                                                                                                                                                                                                                    ACTUATION DEVICES PRODUCTION FACILITY HUMAN SYSTEM INTERFACE                                                                                                                                                                                                            FACILITY CONTROL ROOM HUMAN SYSTEM INTERFACE INDICATION DISPLAYS OPERATOR WORKSTATION                  SUPERVISOR WORKSTATION PICS FACILITY MANUAL                                                      PICS          PICS          PICS    PICS        PICS          PICS PICS                                                                                                    MASTER PICS                                                                                                        ACTUATION SWITCHES OPERATING                PICS                                                                                                  PICS                    PICS          PICS PERMISSIVE PICS SHINE Medical Technologies                                                                                                                                                                                                                                                                                                                                                                        7.1-6                                                                                                                                                                                                                                                                                                                                          Rev. 2
 
Chapter 7 - Instrumentation and Control Systems                                                                                                                                                                                                                                                                                                                    Summary Description Figure 7.1 Target Solution Vessel Reactivity Protection System Architecture TO PICS                      SENSOR INPUTS RX    TX              TX M&I COMMUNICATION SAFETY FUNCTION MODULE MODULE MIB        CTB                  CTB    SDB1  SDB2    SDB3  MIB TRPS DIV C MAINTENANCE                                                                                                                                                                                                                                                                                                                                MAINTENANCE WORKSTATION                                                                                                                                                                                                                                                                                                                                WORKSTATION TO              (MWS) DIV A                                                                                                                                                                                                                                                                                                                                (MWS) DIV B                TO SENSOR INPUTS                                                                                                                                                                                                                                                              SENSOR INPUTS PICS                                                                                                                                                                                                                                                                                                                                                                                  PICS SDB          MIB          SDB        MIB          SDB        MIB SCHEDULE AND              SCHEDULE AND              SCHEDULE AND BYPASS MODULE 1            BYPASS MODULE 2            BYPASS MODULE 3 TX              TX    RX                                                                                                                                    TX      TX              TX      TX              TX      TX                                                                                                                                RX    TX                TX M&I COMMUNICATION                      SAFETY FUNCTION MODULE                                                                                                                                                                                                                                                        SAFETY FUNCTION MODULE                    M&I COMMUNICATION MODULE                                                                                                                                                                                                                                                                                                                                                            MODULE MIB            CTB          CTB    SDB3      SDB2  SDB1    MIB                                                                                                                                                                                                                                            MIB    SDB1    SDB2    SDB3    CTB            CTB          MIB TRPS DIV A                                                                                TRPS DIV B SDB1      SDB2      SDB3  MIB                                    SDB  SDB    MIB          SDB  SDB      MIB            SDB  SDB      MIB                                                                                          MIB  SDB    SDB          MIB    SDB    SDB        MIB  SDB    SDB                                      MIB    SDB3      SDB2    SDB1 HARDWIRED MODULE (HWM)                                                                                                                                                                                                                                                                  HARDWIRED MODULE (HWM)
EQUIPMENT INTERFACE                TRIP/BYPASS              SCHEDULE, BYPASS AND    SCHEDULE, BYPASS AND            SCHEDULE, BYPASS AND                                                                                        SCHEDULE, BYPASS AND        SCHEDULE, BYPASS AND    SCHEDULE, BYPASS AND                  TRIP/BYPASS        EQUIPMENT INTERFACE MODULE        FACILITY INPUTS              VOTING MODULE 3          VOTING MODULE 2                VOTING MODULE 1                                                                                            VOTING MODULE 1              VOTING MODULE 2          VOTING MODULE 3                  FACILITY INPUTS      MODULE PRIORITY                          MANUAL INPUTS                                                                                                                                                                                                                                                                            MANUAL INPUTS                              PRIORITY LOGIC (APL)                        POSITION INPUTS            HW-                HW-  HW-                    HW-    HW-                  HW-                                                                                    HW-                  HW-    HW-                  HW- HW-                HW-            POSITION INPUTS                          LOGIC (APL)
SM    RX  TX  RX    SM    SM    RX  TX    RX    SM    SM    RX  TX    RX    SM                                                                                    SM    RX  RX  TX    SM    SM    RX  RX  TX    SM SM    RX  RX  TX    SM S
S ACTUATED S      EQUIPMENT ACTUATED                                    FROM                                                                                                                                                                                                                                                                                      FROM            FROM THE S                                          FROM THE FROM                TO ESFAS FROM                TO ESFAS FROM                  TO ESFAS                                                                              TO ESFAS              FROM TO ESFAS              FROM TO ESFAS            FROM EQUIPMENT              ACTUATED                                                                                                                                                                                                                                                                                                                                    ACTUATED CONTROL          FIELD    ESFAS DIV            DIV A ESFAS DIV              DIV A ESFAS DIV                DIV A                                                                                  DIV B          ESFAS DIV DIV B            ESFAS DIV DIV B          ESFAS DIV        CONTROL            FIELD      EQUIPMENT EQUIPMENT ROOM                        A SBVM 3          SBVM 3 A SBVM 2              SBVM 2 A SBVM 1                SBVM 1                                                                                SBVM 1            B SBVM 1 SBVM 2            B SBVM 2 SBVM 3          B SBVM 3        ROOM                          POSITION POSITION INDICATION                                                                                                                                                                                                                                                                                                                                  INDICATION LEGEND AND ACRONYMNS HIPS PLATFORM SAFETY FUNCTION MODULE                ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM          MIB - MONITORING AND INDICATION BUS PICS - PROCESS INTEGRATED CONTROL SYSTEM                      MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE HIPS PLATFORM COMMUNICATION MODULE TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM    MWS - MAINTENANCE WORKSTATION HIPS PLATFORM EQUIPMENT INTERFACE MODULE                                                                          RX - RECEIVER APL - ACTUATION AND PRIORITY LOGIC                            SBM - SCHEDULING AND BYPASS MODULE HIPS PLATFORM HARDWIRED MODULE CTB - CALIBRATION AND TEST BUS                                SBVM - SCHEDULING, BYPASS AND VOTING MODULE INTERNAL DIAGNOSTIC AND PARAMETER DATA              EIM - EQUIPMENT INTERFACE MODULE                              SDB - SAFETY DATA BUS INTERNAL SAFETY DATA                              HWM - HARDWIRED MODULE                                        SFM - SAFETY FUNCTION MODULE HW-SM - HARDWIRED SUBMODULE                                  TX - TRANSMITTER EXTERNAL DISCRETE SIGNAL OR DATA SHINE Medical Technologies                                                                                                                                                                            7.1-7                                                                                                                                                                                          Rev. 2
 
Chapter 7 - Instrumentation and Control Systems                                                                                                                                                                                                                                                                                                                      Summary Description Figure 7.1 Engineered Safety Feature Actuation System Architecture TO PICS                      SENSOR INPUTS RX    TX            TX M&I COMMUNICATION SAFETY FUNCTION MODULE MODULE MIB        CTB                CTB    SDB1  SDB2    SDB3    MIB ESFAS DIV C MAINTENANCE                                                                                                                                                                                                                                                                                                                                  MAINTENANCE WORKSTATION                                                                                                                                                                                                                                                                                                                                  WORKSTATION TO                (MWS) DIV A                                                                                                                                                                                                                                                                                                                                  (MWS) DIV B                TO SENSOR INPUTS                                                                                                                                                                                                                                                                SENSOR INPUTS PICS                                                                                                                                                                                                                                                                                                                                                                                        PICS SDB        MIB          SDB        MIB          SDB          MIB SCHEDULE AND              SCHEDULE AND            SCHEDULE AND BYPASS MODULE 1            BYPASS MODULE 2          BYPASS MODULE 3 TX                TX    RX                                                                                                                                      TX      TX              TX      TX              TX        TX                                                                                                                                RX    TX                TX M&I COMMUNICATION                      SAFETY FUNCTION MODULE                                                                                                                                                                                                                                                            SAFETY FUNCTION MODULE                    M&I COMMUNICATION MODULE                                                                                                                                                                                                                                                                                                                                                                MODULE MIB            CTB          CTB    SDB3      SDB2  SDB1    MIB                                                                                                                                                                                                                                              MIB    SDB1    SDB2    SDB3    CTB            CTB          MIB ESFAS DIV A                                                                              ESFAS DIV B SDB1    SDB2      SDB3  MIB                                      SDB  SDB    MIB          SDB    SDB      MIB            SDB  SDB    MIB                                                                                          MIB  SDB      SDB          MIB    SDB    SDB        MIB  SDB    SDB                                      MIB    SDB3      SDB2    SDB1 HARDWIRED MODULE (HWM)                                                                                                                                                                                                                                                                      HARDWIRED MODULE (HWM)
EQUIPMENT INTERFACE                TRIP/BYPASS              SCHEDULE, BYPASS AND    SCHEDULE, BYPASS AND              SCHEDULE, BYPASS AND                                                                                        SCHEDULE, BYPASS AND        SCHEDULE, BYPASS AND    SCHEDULE, BYPASS AND                  TRIP/BYPASS        EQUIPMENT INTERFACE MODULE        FACILITY INPUTS              VOTING MODULE 3          VOTING MODULE 2                  VOTING MODULE 1                                                                                            VOTING MODULE 1              VOTING MODULE 2          VOTING MODULE 3                  FACILITY INPUTS      MODULE PRIORITY                          MANUAL INPUTS                                                                                                                                                                                                                                                                                MANUAL INPUTS                            PRIORITY LOGIC (APL)                        POSITION INPUTS            HW-                HW-  HW-                      HW-    HW-                  HW-                                                                                    HW-                  HW-    HW-                  HW- HW-                HW-            POSITION INPUTS                          LOGIC (APL)
SM    RX  TX  RX    SM  SM    RX    TX    RX    SM      SM    RX  TX  RX    SM                                                                                    SM    RX RX    TX    SM    SM    RX  RX    TX    SM SM    RX  RX  TX    SM S
S ACTUATED S      EQUIPMENT ACTUATED                                  FROM                                                                                                                                                                                                                                                                                          FROM FROM THE S                                          FROM THE FROM                  TO TRPS FROM                  TO TRPS FROM                    TO TRPS                                                                              TO TRPS          FROM TRPS TO TRPS            FROM TRPS TO TRPS        FROM TRPS EQUIPMENT              ACTUATED                                                                                                                                                                                                                                                                                                                                        ACTUATED CONTROL            FIELD      TRPS DIV            DIV A TRPS DIV                DIV A TRPS DIV                DIV A                                                                                DIV B                DIV B  DIV B              DIV B  DIV B              DIV B        CONTROL          FIELD        EQUIPMENT EQUIPMENT ROOM                          A SBVM 3          SBVM 3 A SBVM 2                SBVM 2 A SBVM 1                SBVM 1                                                                                SBVM 1            SBVM 1 SBVM 2                SBVM 2 SBVM 3            SBVM 3          ROOM                          POSITION POSITION INDICATION                                                                                                                                                                                                                                                                                                                                      INDICATION LEGEND AND ACRONYMNS HIPS PLATFORM SAFETY FUNCTION MODULE              ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM            MIB - MONITORING AND INDICATION BUS PICS - PROCESS INTEGRATED CONTROL SYSTEM                      MI-CM - MONITORING AND INDICATION COMMUNICATION MODULE HIPS PLATFORM COMMUNICATION MODULE TRPS - TARGET SOLUTION VESSEL REACTIVITY PROTECTION SYSTEM    MWS - MAINTENANCE WORKSTATION HIPS PLATFORM EQUIPMENT INTERFACE MODULE                                                                        RX - RECEIVER APL - ACTUATION AND PRIORITY LOGIC                            SBM - SCHEDULING AND BYPASS MODULE HIPS PLATFORM HARDWIRED MODULE CTB - CALIBRATION AND TEST BUS                                SBVM - SCHEDULING, BYPASS AND VOTING MODULE INTERNAL DIAGNOSTIC AND PARAMETER DATA            EIM - EQUIPMENT INTERFACE MODULE                              SDB - SAFETY DATA BUS INTERNAL SAFETY DATA                            HWM - HARDWIRED MODULE                                        SFM - SAFETY FUNCTION MODULE HW-SM - HARDWIRED SUBMODULE                                    TX - TRANSMITTER EXTERNAL DISCRETE SIGNAL OR DATA SHINE Medical Technologies                                                                                                                                                                            7.1-8                                                                                                                                                                                            Rev. 2
 
1        SYSTEM DESCRIPTION SHINE facility instrumentation and control systems are described in Section 7.1 and are e fully described in Chapter 7.
SHINE safety-related instrumentation and control systems are:
* the target solution vessel (TSV) reactivity protection system (TRPS) (Section 7.4)
* the engineered safety feature actuation system (ESFAS) (Section 7.5)
* the neutron flux detection system (NFDS) (Section 7.8)
* safety-related process radiation monitors associated with the TRPS, ESFAS and tritium purification system (TPS) (Section 7.7)
SHINE nonsafety-related instrumentation and control systems are:
* the process integrated control system (PICS) and vendor-provided controls (Section 7.3)
* facility control room (FCR) control consoles and displays (Section 7.6)
* nonsafety-related radiation monitors (Section 7.7) mplified block diagram of the overall I&C system architecture is provided in Figure 7.1-1.
ailed descriptions of the above systems, including equipment and major components, control protection system development processes, and operational, support, and operator interface uirements, are provided in Sections 7.3 through 7.8.
NE uses a documented methodology for establishing and calibrating setpoints for safety-ted I&C functions. A combination of statistical and algebraic methods is used to combine rument uncertainties to determine the total instrument loop uncertainty for each setpoint. The hodology considers both random and non-random uncertainties, and considers process asurement and miscellaneous effects uncertainties, sensor uncertainties, and protection tem processing uncertainties. Instrument drift between calibrations is accounted for in the oint methodology.
NE safety limits will not be exceeded if required actions are initiated before analytical limits exceeded. Analytical limits are chosen to include a conservative margin between the lytical limit and the safety limit. The limiting safety system setting (LSSS) is the least servative value that the instrument setpoint can be and still ensure the analytical limits are not eeded and the safety limits are protected. The LSSS is separated from the analytical limit by amount not less than the total loop uncertainty for the setpoint determined by the hodology discussed above.
2        DESIGN CRITERIA design criteria of the I&C systems were derived from the criteria in 10 CFR 50, Appendix A, 10 CFR 70.64(a), as described in Table 3.1-3, as well as guidance provided in Chapter 7 of REG-1537, Part 1 and the Final Interim Staff Guidance (ISG) Augmenting NUREG-1537, t 1. The criteria were applied in a graded approach to each I&C system.
NE Medical Technologies                        7.2-1                                        Rev. 2
 
provided in Sections 7.3 through 7.8. Sections 7.3 through 7.8 additionally describe how the lity design criteria and system-specific design criteria are met or implemented for each I&C tem.
es and standards used in the design of each I&C system are also identified in Sections 7.3 ugh 7.8.
3      DESIGN BASES design bases requirements identified for each I&C system in Sections 7.3 through 7.8 are blished for safe facility operation and to prevent or mitigate the process hazards and ential accident sequences identified in the accident analysis described in FSAR Chapter 13.
I&C design meets established design criteria to ensure safety functions are performed sistently and completely to fulfill the safety intent.
ety functions, applicable modes of operation, permissive conditions, monitored variables and r ranges, conditions for manual control, and any other special design bases requirements cific to each of the I&C systems are described in Sections 7.3 through 7.8.
ironmental and radiological parameters applicable to I&C components located in different as of the facility are provided in Tables 7.2-1 through 7.2-6 and are referred to in Sections 7.3 ugh 7.8.
ironmental parameters inside the main production facility are maintained by the facility ting, ventilation, and air conditioning (HVAC) systems, which are described in Section 9a2.1.
4      OPERATION AND PERFORMANCE ration and performance are addressed for each instrumentation and control system in tions 7.3 through 7.8. The operation and performance analysis describes how the system ign criteria and design bases are met for performance of the system design functions. The ussions include, but are not limited to, descriptions of instrumentation and control system ons, setpoints, and how a single failure affects the ability of the system to perform the safety tions.
NE Medical Technologies                      7.2-2                                        Rev. 2
 
Table 7.2 Design Radiation Environments Location                            Normal                  Transient dioisotope production facility (RPF) 1.0E+3 Rad TID, 5 mR/hr          100 mR/hr neral area adiation facility (IF) general area        1.0E+3 Rad TID, 5 mR/hr          50 mR/hr tium purification system (TPS) 50 Rad TID, 0.25 mR/hr            5 mR/hr om, glovebox and exhaust duct adiation unit (IU) cell above the light 1.8E+8 Rad TID, 1E+3 R/hr        1E+3 R/hr ter pool cell near dump tank and flux 1.8E+10 Rad TID, 1E+5 R/hr        1E+5 R/hr tectors (in light water pool) ide the target solution vessel (TSV) 5.4E+8 Rad TID, 3E+3 R/hr        3E+3 R/hr
-gas system (TOGS) instrument box ide the TOGS cell, outside 1.2E+10 Rad TID, 7E+4 R/hr        7E+4 R/hr trument box ide the cooling room                    1.8E+4 Rad TID, 100 mR/hr          100 R/hr e: (1)  Total integrated dose (TID) is calculated over a 20-year timeframe.
(2)  Design radiation environments lower than those listed may be defined for specific locations using additional analysis or localized shielding.
NE Medical Technologies                    7.2-3                                    Rev. 2
 
Table 7.2 Facility Control Room Design Environmental Parameters Parameter                            Normal                Transient mperature                                  60ºF to 80ºF            40ºF to 120ºF essure                                        Ambient                Ambient 10 percent to 80 percent 10 percent to 95 percent lative Humidity (non-condensing)        (non-condensing)
NE Medical Technologies                  7.2-4                                  Rev. 2
 
Table 7.2 RPF and IF General Area Design Environmental Parameters Parameter                          Normal                Transient mperature                                65ºF to 85ºF            40ºF to 120ºF essure                                      Ambient                Ambient 10 percent to 80 percent 10 percent to 95 percent lative Humidity (non-condensing)        (non-condensing)
NE Medical Technologies                7.2-5                                  Rev. 2
 
Table 7.2 IU Cell Interior Design Environmental Parameters Parameter                          Normal                    Transient mperature                                40ºF to 104ºF              40ºF to 120ºF ssure                                      Ambient              14 psia to 19 psia 10 percent to 100 percent  10 percent to 100 percent ative Humidity (condensing)              (condensing)
NE Medical Technologies                7.2-6                                    Rev. 2
 
Table 7.2 TOGS Cell Interior Design Environmental Parameters Parameter                      Normal                      Transient mperature                          40ºF to 104ºF                40ºF to 120ºF ssure                                  Ambient                14 psia to 19 psia 10 percent to 100 percent    10 percent to 100 percent ative Humidity (condensing)                (condensing)
NE Medical Technologies                7.2-7                                    Rev. 2
 
Table 7.2 Primary Cooling Room Interior Design Environmental Parameters Parameter                        Normal                  Transient mperature                              40ºF to 120ºF            40ºF to 120ºF essure                                    Ambient                  Ambient 10 percent to 80 percent  10 percent to 95 percent lative Humidity (non-condensing)          (non-condensing)
NE Medical Technologies                7.2-8                                    Rev. 2
 
SHINE facility is provided with nonsafety-related control systems necessary to perform mal operational activities within the facility. The process integrated control system (PICS) is a safety-related digital control system that performs various functions throughout the SHINE lity. The PICS is the primary interface for operators to perform tasks in both the irradiation lity (IF) and the radioisotope production facility (RPF). PICS functions include signal ditioning, system controls, interlocks, and monitoring of the process variables and system us.
dor-provided nonsafety-related control systems, which interface and communicate with the S, are also present within the SHINE facility and are used to monitor and control specific lity systems.
main control board and operator workstations in the facility control room are also part of the S and are described in Section 7.6.
1        SYSTEM DESCRIPTION PICS is a collection of instrumentation and control equipment located throughout the facility upport monitoring, indication, and control of various systems. A portion of the PICS supports main control board and operator workstations in the facility control room by receiving operator mands and collecting and transmitting facility information to the operators, as described in tion 7.6. An architecture of the PICS is provided in Figure 7.3-1.
following vendor-provided nonsafety-related control systems are also provided for the NE facility:
* The building automation system is a digital control system capable of integrating multiple building functions, including equipment supervision and control, alarm management, energy management, and trend data collection. It provides control for the facility heating water system (FHWS), the facility chilled water system (FCHS), the process chilled water system (PCHS), the radioisotope process facility cooling system (RPCS), facility ventilation zone 4 (FVZ4) air handling, and radiological ventilation zone 1, 2, and 3 (RVZ1/2/3) air handling. The building automation system receives commands from the PICS to start and stop select control sequences and provides information to the PICS for monitoring.
* The supercell contains a local control system and human system interface equipment for controlling hot cell functions including interior lighting, interior temperature and pressure, and operation of the doors, ports, and waste export system. The supercell control system provides information to PICS for monitoring only.
* The radioactive liquid waste immobilization (RLWI) system contains a local control system and human system interface equipment for controlling RLWI equipment functions including operation of equipment used to handle solidified waste. The RLWI control system provides information to PICS for monitoring only.
* The neutron driver assembly system (NDAS) control system is used to monitor and make adjustments to any of the eight neutron drivers in the eight irradiation unit (IU) cells. Two NDAS control stations are provided in the facility control room as described in Subsection 7.6.1.2, and a portable local station is provided as described in Subsection 7.6.1.6. The NDAS control system is further described in Subsection 4a2.3.4.
NE Medical Technologies                      7.3-1                                          Rev. 4
* The standby generator system (SGS) generator, facility demineralized water system (FDWS) reverse osmosis (RO) unit, facility nitrogen handling system (FNHS) unit, FHWS boilers, and FCHS and PCHS chillers are each provided with integral controllers that interface with the PICS (for the SGS generator, FDWS RO unit, and FNHS unit) or the building automation system (for boilers and chillers).
escription of the PICS process monitoring functions, control functions, interlocks, alarms, and lays is provided for each facility system where the PICS provides these functions. If licable, the vendor-provided nonsafety-related controls are also described for each facility tem. In addition to the variables described below, PICS monitors valve or damper position dback as needed to perform control functions or implement interlocks and permissives.
1.1          Irradiation Unit Systems PICS is used to monitor parameters and perform manual and automatic actions during each he operational modes of a subcritical assembly system (SCAS):
Mode 0 - Solution Removed: No target solution in the SCAS Mode 1 - Startup: Filling the target solution vessel (TSV)
Mode 2 - Irradiation: Operating mode (neutron driver active)
Mode 3 - Post-Irradiation: TSV dump valves open Mode 4 - Transfer to the RPF: Dump tank drain valve opens to permit solution transfer systems associated with SCAS modes of operation include the SCAS itself, the NDAS, the off-gas system (TOGS), the primary closed loop cooling system (PCLS), and the neutron detection system (NFDS).
de 0 - Solution Removed ode 0, the PICS provides the capability to control equipment needed to transition an IU into de 1, including closing the TSV fill valves and dump valves and starting the TOGS blowers as ded to meet mode transition criteria. The PICS also provides monitoring and controls of the mon tritium purification system (TPS), which is integrated with the modes of operation for h IU cell.
de 1 - Startup Mode r the operator transitions the IU to Mode 1 using the operating mode input to the TSV ctivity protection system (TRPS), the PICS is used to open the TSV fill valves and operate the uum transfer system (VTS) to add target solution to the TSV from the associated target tion hold tank.
TSV is filled incrementally. The TSV fill increment is determined by 1/M calculations. The rator may use the PICS as a check to calculate the next required fill volume based on the calculation. The PICS also provides defense-in-depth time limits and interlocks to control the ximum volumetric step addition during the 1/M fill process to prevent challenging the TRPS Stop actuation function described in Section 7.4.
NE Medical Technologies                      7.3-2                                      Rev. 4
 
en the TSV fill has been completed, PICS is used to close the TSV fill valves to meet Mode 2 sition criteria. The PICS provides an interlock with the source range channel of the NFDS to vent TSV irradiation without sufficient neutron counts on the detectors and, when that missive is met, PICS is used to close the neutron driver breakers to enable the target solution e TSV to be irradiated. The PICS interfaces with the NDAS control system to start or stop the er and is used to control the introduction of tritium into the NDAS target from the TPS.
ing irradiation, PICS is used to monitor neutron flux levels, concentrations of radiolytic gases erated, NDAS performance parameters, and other parameters associated with the irradiation cess.
de 3 - Post-Irradiation neutron driver breakers are opened by the PICS, ending the irradiation period and satisfying mode transition criteria, allowing the operator to transition from Mode 2 to Mode 3. When sitioning from Mode 2 to Mode 3 during normal operations, the PICS provides the mode sition signal from the TRPS to automatically open the TSV dump valves to drain the target tion to the dump tank. While in Mode 3, the PICS is used to monitor TOGS and SCAS rational parameters while the solution is held for decay.
de 4 - Transfer to RPF r the operator transitions the IU to Mode 4, the PICS is used to open the TSV dump tank n isolation valve allowing the target solution to be vacuum lifted out of the IU cell, pumped ugh an extraction column, and drained to a target solution hold tank. The PICS is used to ct the flow path for the transfer to the desired extraction cell and to operate the VTS which omplishes the lift.
en the solution has been removed from the dump tank, the operator uses PICS to verify that
-high TSV dump tank level is inactive, meeting the Mode 4 to Mode 0 transition criteria.
1.1.1        Subcritical Assembly System SCAS maintains fissile material in a subcritical, but highly multiplying configuration during irradiation process to produce molybdenum-99 (Mo-99) and other fission products. The AS is described in Section 4a2.2.
nitoring and Alarms PICS is used to monitor and provide alarms for TSV level, TSV temperature, and TSV dspace pressure for each IU. TSV dump tank level is monitored using two level switches
-high and high-high), which are provided to PICS via TRPS (Subsections 7.4.4.1.8 and 4.1.9).
S also provides alarms for automatic or manual actuation of the TRPS safety functions cribed in Subsection 7.4.3.1 and the TRPS Fill Stop described in Subsection 7.4.4.1.18.
NE Medical Technologies                      7.3-3                                        Rev. 4
 
operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.
PICS provides a signal to the TRPS, when manually initiated by the operator, to sequentially sition the TRPS from one mode to the next.
en a TSV fill sequence is manually initiated, the PICS opens and closes the TSV lift tank uum valve and the TSV fill valves according to a programmed sequence to add a manually ered prescribed volume to the TSV. The PICS uses feedback from the TSV fill lift tank level ches and valve position indication to accomplish this sequence. At or above 40 percent of the ximum 95 percent fill neutron flux, the time the TSV fill valve is open is limited to less than
            ]PROP/ECI to prevent reliance on the TRPS Fill Stop function (Subsection 7.4.4.1.18).
TSV fill lift sequence can be manually aborted by the operator.
en a TSV drain sequence is manually initiated and the operator manually enters a solution time, the PICS provides a signal to the TRPS to transition to Mode 3, opens the TSV dump es, verifies the TSV lift tank vacuum valve is closed, and opens the TSV fill valves to drain target solution remaining in the fill lines to the TSV dump tank via the TSV. When TSV level cates the TSV is drained, the PICS closes the TSV fill valves and starts a timer for the viously entered solution hold time.
solution hold time portion of the TSV drain sequence can be manually aborted by the rator.
rlocks and Permissives PICS provides an interlock at or above 40 percent of the maximum 95 percent fill neutron to limit the fill rate of the TSV.
PICS additionally provides permissives and interlocks to:
* Prevent the NDAS high voltage power supply (HVPS) from being energized if any of the TSV fill valves, TSV dump valves, TSV dump tank drain valve, or nitrogen purge system (N2PS) inerting gas isolation valves are open.
* Prevent the TSV fill valves from opening in Mode 1 if the median value of the three values of TOGS mainstream flow inputs for both TOGS trains is below the allowable value.
* Prevent the TSV fill valves from opening in Mode 1 if either TSV dump valve is open.
* Prevent the TSV dump tank drain valve from opening until the solution hold time has elapsed.
* Allow transition from Mode 0 to Mode 1 only when both TSV dump valves are closed, both TSV fill valves are closed, and TSV level is below an allowable level, indicating solution is not present.
* Allow transition from Mode 1 to Mode 2 only when both TSV dump valves are closed, both TSV fill valves are closed, and TSV level is above an allowable level, indicating the TSV contains sufficient solution for irradiation.
NE Medical Technologies                      7.3-4                                        Rev. 4
 
present indicating solution is in the TSV dump tank.
* Allow transition from Mode 4 to Mode 0 only when TSV level is below an allowable level indicating solution has been drained, the TSV dump tank low-high level signal is clear indicating solution has been removed from the TSV dump tank, and the TSV fill valves are closed.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.1.2        Target Solution Vessel Off-Gas System TOGS is used to manage radiolysis and fission product gases generated in the TSV during diation operation and present in the TSV dump tank during target solution cooldown to ntain concentrations within safe limits. The TOGS is described in Section 4a2.8.
nitoring and Alarms PICS receives input from the TRPS and provides alarms for TOGS oxygen concentration bsection 7.4.4.1.10), mainstream flow for both train A and B (Subsection 7.4.4.1.11),
denser demister outlet temperatures for both train A and B (Subsection 7.4.4.1.13), and p tank flow for train A (Subsection 7.4.4.1.12).
PICS directly monitors and provides alarms for TOGS hydrogen concentration, gas injection rate, TOGS blower outlet and sidestream pressures, instrument demister condensate high l switch and condenser demister outlet, sweep gas supply, recombiner inlet, recombiner et, zeolite bed inlet, and zeolite bed outlet temperatures.
trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.
following functions are performed while TOGS is running (Mode 1, 2, 3, or 4):
S automatically controls mainstream flow for each TOGS train based on the median value of three mainstream flow inputs received from TRPS by adjusting the variable speed motor of associated train TOGS blower.
S automatically controls the temperature of the recombiners (trains A and B) and the zeolite (train A) by energizing or deenergizing the associated heater based on the inlet and outlet perature of each component.
S automatically opens the TOGS oxygen inlet valve when oxygen concentration is low, ed on the median value of the three TOGS oxygen concentration inputs received from TRPS.
NE Medical Technologies                      7.3-5                                      Rev. 4
 
gen concentration is low, PICS closes the TOGS oxygen inlet valve prior to opening the GS vacuum tank inlet valve. If TSV headspace pressure is too low, PICS opens the TOGS ogen inlet valve.
S automatically controls the position of the TOGS gas inlet flow control valve to maintain a stant gas injection flowrate when either the TOGS oxygen or nitrogen inlet valve is open.
following functions are performed while TOGS is not running (Mode 0):
en manually initiated by the operator, the PICS executes a programmed sequence to cuate the TOGS vacuum tank by opening and closing the TOGS vacuum tank inlet valve, ning and closing the TOGS vacuum tank outlet valve, and opening and closing the vacuum ply valves in a specific order.
en manually initiated by the operator, the PICS executes a programmed sequence to start the GS by ensuring TOGS valves are in their required states, enabling the TOGS control loops, starting the TOGS blowers. This sequence places the TOGS in a Running state.
rlocks and Permissives S provides interlocks and permissives to:
* Prevent the TOGS vacuum tank inlet valve and TOGS vacuum tank outlet valve from being open simultaneously.
* Prevent the TOGS oxygen inlet valve and TOGS nitrogen inlet valve from being open simultaneously.
* Prevent the TOGS vacuum tank inlet valve from being open when either the TOGS oxygen inlet valve or the TOGS nitrogen inlet valve is open.
* Allow the transition from Mode 0 to Mode 1 only when TOGS is in a Running state.
* Allow the transition from Mode 1 to Mode 2 only when TOGS is in a Running state.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.1.3        Primary Closed Loop Cooling System PCLS provides forced convection water cooling to the TSV and neutron multiplier during diation of the target solution and immediately prior to transferring target solution from the TSV he TSV dump tank. The PCLS is described in Section 5a2.2.
nitoring and Alarms PICS receives input from the TRPS and provides alarms for PCLS cooling water flow bsection 7.4.4.1.7) and PCLS cooling water supply temperature (Subsections 7.4.2.1.5 and 2.1.6).
PICS receives direct input and provides alarms for PCLS pressure, PCLS conductivity, LS expansion tank level, PCLS cleanup side stream flow, PCLS cooling water temperature NE Medical Technologies                    7.3-6                                          Rev. 4
 
LS instrumentation is further described in Subsections 5a2.2.3 and 5a2.5.2.
trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS are controlled by S as described in Subsection 7.3.1.3.11.
S automatically controls the position of the RPCS outlet control valve from the PCLS heat hanger to maintain the nonsafety-related PCLS cooling water supply temperature indication in an acceptable band.
en manually initiated by the operator, the PICS executes a programmed sequence to start or the PCLS by ensuring PCLS valves are in their required states, enabling or disabling the LS temperature control loop, and allowing the operator to start or stop the PCLS pump ors. Starting at least one PCLS pump places PCLS in a Running state.
rlocks and Permissives S provides interlocks and permissives to:
* Prevent the PCLS pumps from starting if the PCLS supply isolation valve or either PCLS return isolation valve is closed.
* Prevent the PCLS pumps from starting if PCLS expansion tank level is low.
* Prevent the PCLS pumps from starting if PCLS suction pressure is low.
* Allow the transition from Mode 0 to Mode 1 only when PCLS is in a Running state.
* Allow the transition from Mode 1 to Mode 2 only when PCLS is in a Running state.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.1.4        Light Water Pool System light water pool system (LWPS) provides neutron moderation and reflection to reduce tron leakage, radiation shielding, and decay heat removal from target solution following diation. The LWPS is described in Subsection 4a2.4.2.
nitoring and Alarms PICS receives input and provides alarms for LWPS pool level and LWPS pool temperature each IU.
trol Functions e
NE Medical Technologies                    7.3-7                                      Rev. 4
 
e 1.1.5        Neutron Driver Assembly System NDAS is the source of neutrons used to generate the neutron fluxes required to create dical isotopes in the TSV. The NDAS produces neutrons by colliding a deuterium (D) ion m with tritium (T) gas. The NDAS is directly controlled by a vendor-provided nonsafety-ted control system. The NDAS is described in Section 4a2.3.
nitoring and Alarms NDAS is directly monitored by a vendor-provided nonsafety-related control system. The AS control system monitors deuterium-tritium (DT) neutron yield, beam current, target ssure, leakage indications, various system voltages, currents and temperatures, and dback from vacuum pumps and other system components.
NDAS control system provides a subset of these monitored parameters and the status of the tem (System Off, Vacuum, Prepared, Standby, or Beam On) to the PICS for display on the S workstations and generation of alarms.
trol Functions NDAS control system allows the operator to manually adjust (e.g., focus or direct) the terium beam by changing voltages and currents applied to various solenoid magnets. The AS control system also allows the operator to control the ion source by adjusting microwave er, current, and voltage to manually start and stop various system auxiliaries (e.g., vacuum ps, blowers, cooling pumps), and to open and close NDAS system valves.
local NDAS control station is only used for maintenance and commissioning activities for an AS unit installed in an IU, or for an NDAS unit located in the NDAS service cell.
operator uses PICS to provide signals to manually open or close the neutron driver HVPS akers to meet TRPS mode transition criteria and allow the beam to be energized. The rator is able to use the PICS to manually open and close individual valves that are capable of g actuated by TRPS as described in Subsection 7.3.1.3.11.
rlocks and Permissives PICS provides permissive signals to the NDAS control system to:
* Allow the use of the control room NDAS control station, specific to each NDAS unit.
* Allow the control room NDAS control station to transition a specific NDAS unit to Beam On status.
* Allow the use of the local NDAS control station.
moval of the PICS permissive signal for Beam On operation causes the beam to deenergize.
NE Medical Technologies                    7.3-8                                        Rev. 4
* Prevent the transition of an NDAS unit to Beam On when the NFDS source range count rate is below an allowable value.
* Allow the transition from Mode 1 to Mode 2 only when the NDAS is in Standby.
* Allow the transition from Mode 2 to Mode 3 only when the NDAS is not in Beam On.
* Allow the transition from Mode 3 to Mode 4 only when the NDAS is not in Beam On.
* Allow the transition from Mode 4 to Mode 0 only when the NDAS is not in Beam On.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.1.6        Neutron Flux Detection System NFDS monitors the neutron flux in the IU during TSV fill and irradiation. The NFDS is cribed in Section 7.8.
nitoring and Alarms PICS receives input from the TRPS for monitoring and provides alarms for source range tron flux (Subsection 7.4.4.1.1), wide range neutron flux (Subsection 7.4.4.1.4), and power ge neutron flux (Subsections 7.4.2.1.2 and 7.4.4.1.3), as described in Subsection 7.8.3.9.
PICS indirectly receives discrete signals from the NFDS for source range missing and wer range missing faults for the generation of alarms (Subsection 7.8.3.10).
trol Functions e
rlocks and Permissives e
1.2          Supercell Systems PICS provides automated and manual control of systems associated with the supercell, ch are used to transfer target solution between locations within the facility and extract and fy isotopes of interest. The supercell includes a vendor-provided nonsafety-related control tem that is used by the operator to manually control hot cell (non-process) functions.
1.2.1        Molybdenum Extraction and Purification System ope extraction and purification activities are performed by the molybdenum extraction and fication system (MEPS), molybdenum isotope product packaging system (MIPS), and iodine xenon purification and packaging (IXP) system. The MEPS is located in six hot cells of the ercell (extraction areas A, B, and C and purification areas A, B, and C) and is used to extract ybdenum from target solution and purify it, as described in Section 4b.3.
NE Medical Technologies                    7.3-9                                        Rev. 4
 
nitoring and Alarms PICS receives input from the engineered safety features actuation system (ESFAS) and vides alarms for the position of the MEPS extraction column three-way valves bsection 7.5.4.1.16) and the MEPS Heating Loop radiation (Subsection 7.5.4.1.6).
PICS directly monitors and provides alarms for molybdenum eluate hold tank level, harge pressure and status feedback from system pumps, MEPS evaporator temperature, various other system temperatures and pressures. The PICS also monitors the weight of ples obtained from various processes, but no alarms are provided.
the MEPS hot water loop, the PICS monitors and provides alarms for temperature, flow, and ssure at various locations.
PICS also provides alarms for automatic or manual Extraction Column A/B/C Alignment uations and MEPS A/B/C Heating Loop Isolations described in Subsection 7.5.3.1.
trol Functions en a target solution extraction sequence is manually initiated by the operator, the PICS cutes a programmed sequence to transfer solution from one manually selected TSV dump to a manually selected supercell extraction hot cell using the VTS. The PICS opens and es the associated TSV dump tank drain isolation valve and appropriate system isolation es based on feedback from associated VTS lift tank level switches and the selected TSV p tank low-high level switch to accomplish the solution transfer. The PICS also starts and s the associated extraction feed pump as part of the sequence.
ing a target solution extraction sequence, the PICS automatically controls the temperature of MEPS hot water loop by energizing and deenergizing the hot water loop heater based on the et water temperature from the heater. Additionally, the PICS automatically controls the rate of er flow through the heat exchanger based on the temperature of the target solution.
en initiated by the operator during a purification operation, the PICS automatically controls the perature of the MEPS evaporator by energizing and deenergizing the evaporator heater.
er than performance of a target solution extraction sequence and the automatic PICS control ctions described above, the tasks performed by the operator for the MEPS are manual. The rator is able to use the PICS local supercell control stations to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.
supercell control system is used by the operator to manually control hot cell (non-process) tions.
NE Medical Technologies                    7.3-10                                      Rev. 4
 
PICS provides permissives and interlocks to:
* Prevent initiation of a target solution extraction sequence if the associated IU from where solution is being transferred is not in Mode 4.
* Prevent opening of any of the supercell reagent feed isolation valves while a target solution extraction sequence is in progress.
* Prevent alignment of MEPS three-way valves in a way that could misdirect fluid and challenge the operation of system check valves.
* Stop or prevent from starting system pumps when discharge pressure is above an allowable limit.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.2.2        Molybdenum Isotope Product Packaging System MIPS is located in two hot cells of the supercell (packaging areas 1 and 2) and is used to kage isotopes received from the MEPS and IXP, as described in Subsection 9b.7.1.
nitoring and Alarms S monitors the weight of the Mo-99 product from the MEPS and the weight of the Xe-133 and 1 products from the IXP system. No alarms are provided.
trol Functions supercell control system is used by the operator to manually control hot cell (non-process) tions.
rlocks and Permissives e
1.2.3        Iodine and Xenon Purification and Packaging System IXP is located in a hot cell of the supercell (IXP area) and is used to extract and purify opes of iodine and xenon. The IXP is described in Subsection 4b.3.1.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the position of the IXP three-valves (Subsection 7.5.4.1.17).
PICS directly monitors and provides alarms for IXP eluate hold tank level, [
                                                                            ]PROP/ECI, xenon trap temperature, and various other system temperatures and pressures. The PICS also nitors the weight of samples obtained from various processes, but no alarms are provided.
NE Medical Technologies                        7.3-11                                      Rev. 4
 
trol Functions tasks performed by the operator for the IXP are manual. The operator is able to use the S local supercell control stations to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by ESFAS are controlled by S as described in Subsection 7.3.1.3.11.
supercell control system is used by the operator to manually control hot cell (non-process) tions.
rlocks and Permissives PICS provides permissives and interlocks to:
* Prevent opening of any of the supercell reagent feed isolation valves while an IXP target solution supply valve is open.
* Prevent alignment of IXP three-way valves in a way that could misdirect fluid and challenge the operation of system check valves.
*    [
                                          ]PROP/ECI cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.2.4        Process Vessel Vent System process vessel vent system (PVVS) provides ventilation of tanks and vessels located in the F that may contain radioactive solutions in order to mitigate the potential buildup of hydrogen is generated via radiolysis. A portion of the PVVS equipment is located in a hot cell of the ercell (PVVS area), with other equipment located in the main production facility mezzanine or elow grade vaults. The PVVS is described in Subsection 9b.6.1.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for PVVS flow bsection 7.5.4.1.15) and PVVS carbon delay bed exhaust carbon monoxide bsection 7.5.4.1.7).
PICS directly monitors and provides alarms for nonsafety-related PVVS supply flow to vidual tanks and vessels serviced by PVVS, PVVS reheater temperatures, PVVS condensate k level, PVVS condenser cooling water temperature, PVVS carbon guard bed train exhaust perature and differential pressure, PVVS carbon delay bed temperatures, and other system peratures, pressures, and flows.
PICS also provides alarms for automatic or manual Carbon Delay Bed Group 1/2/3 ations described in Subsection 7.5.3.1.
NE Medical Technologies                    7.3-12                                      Rev. 4
 
operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by ESFAS are controlled by S as described in Subsection 7.3.1.3.11.
PICS provides automatic control of PVVS condensate transfer by stopping the condensate harge pump on low PVVS condensate tank level after the operator has manually selected the tination tank and initiated the transfer.
PICS provides automatic control of the PVVS makeup air supply valve by monitoring safety-related PVVS return flow (from tanks and vessels serviced by PVVS), to maintain total to the PVVS blowers constant.
PICS automatically controls temperature by energizing and deenergizing the PVVS eaters based on the PVVS reheater downstream temperature.
supercell control system is used by the operator to manually control hot cell (non-process) tions.
rlocks and Permissives PICS provides interlocks and permissives to:
* Close the PVVS inlet valve to a carbon guard bed train if differential pressure for the associated carbon guard bed train is above an allowable limit, and open the PVVS inlet and outlet valves and start the PVVS reheater for the redundant carbon guard bed train.
* Close the PVVS inlet and outlet valves for a carbon guard bed train if exhaust temperature for the associated carbon guard bed train is above an allowable limit, and open the PVVS inlet and outlet valves and start the PVVS reheater for the redundant carbon guard bed train.
* Open the carbon guard bed bypass valves if both carbon guard bed train PVVS inlet valves are closed.
* Isolate flow from the PVVS condensate tank on high level in the first uranium liquid waste tank.
* Isolate flow from the PVVS condensate tank on high level in the liquid waste blending tanks.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.2.5        Vacuum Transfer System get solution transfer activities occur throughout the main production facility in order to remove diated solution from the TSV dump tank, extract isotopes, and return target solution to an IU.
se activities are accomplished by the VTS and target solution staging system (TSSS). The consists of vacuum pumps and a vacuum buffer tank located in a hot cell of the supercell located with the PVVS in the PVVS area) and lift tanks, as described in Subsection 9b.2.5.
NE Medical Technologies                      7.3-13                                          Rev. 4
 
PICS receives input from the ESFAS and provides alarms for the VTS vacuum header liquid ection switches (Subsection 7.5.4.1.8).
PICS directly monitors and provides alarms for vacuum system pressure, individual VTS lift level switches, VTS vacuum buffer tank level switches, target solution sample line level ches, and status feedback information from the VTS vacuum pumps.
PICS also provides alarms for automatic or manual VTS Safety Actuation described in section 7.5.3.1.
trol Functions operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences. Components that are capable of being actuated by TRPS or ESFAS are trolled by PICS as described in Subsection 7.3.1.3.11.
en initiated by the operator, the PICS starts or stops the VTS by enabling or disabling the uum system pressure control loop.
PICS automatically starts and stops the second of two VTS vacuum pumps to maintain uum system pressure within an allowable range.
supercell control system is used by the operator to manually control hot cell (non-process) tions.
rlocks and Permissives PICS provides interlocks and permissives to:
* Close or prevent opening of individual VTS lift tank or target solution sample line vacuum valves when the corresponding VTS lift tank or target solution sample line high level switch signal is active.
* Close or prevent opening VTS vacuum buffer tank vacuum valves, stop or prevent from starting the VTS vacuum pumps, and open the VTS vacuum buffer tank drain valve on high level in the VTS vacuum buffer tank.
* Prevent the vacuum transfer sequence from starting if level in the destination tank selected is above an allowable limit.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.2.6        Target Solution Staging System TSSS is used in conjunction with the VTS (Subsection 7.3.1.2.5), and consists of hold tanks storage tanks located in subgrade vaults. The TSSS is described in more detail in section 4b.4.1.1.
NE Medical Technologies                    7.3-14                                          Rev. 4
 
PICS monitors and provides alarms for two diverse methods of level indication for the vidual TSSS tanks, and temperature indication for the individual TSSS tanks. The PICS itionally provides alarms when tank level or transfer time is outside of expected parameters ng a solution transfer sequence.
trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from one manually selected TSSS tank to another manually selected tank using the
  . The PICS opens and closes the appropriate system isolation valves based on feedback VTS lift tank level switches and the selected hold or storage tank level indication to omplish the solution transfer.
n-progress solution transfer sequence can be manually aborted by the operator.
en manually initiated by the operator, the PICS executes a programmed sequence to obtain a ple from a manually selected TSSS tank. The PICS opens and closes the appropriate uum valves and sampling isolation valves to accomplish the sampling activity.
operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.
rlocks and Permissives PICS provides interlocks to:
* Prevent a vacuum transfer sequence from starting in a hold or storage tank when the temperature in the associated tank is above an allowable limit.
* Stop a vacuum transfer sequence on high level in the destination tank.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.3            Ancillary Process Systems PICS provides automated and manual control of systems used to prepare target solution, nage radioactive waste, control tritium provided to the neutron drivers, and perform other lity process monitoring and control functions.
1.3.1        Uranium Receipt and Storage System uranium receipt and storage system (URSS) is used to receive uranium prior to conversion arget solution. The URSS is described in detail in Subsection 4b.4.2.1.
NE Medical Technologies                    7.3-15                                        Rev. 4
 
PICS monitors and provides alarms for URSS glovebox pressures, URSS glovebox air flow, URSS glovebox temperatures.
ngle local control station is associated with the URSS and target solution preparation system PS) which is capable of displaying URSS and TSPS indications and alarms to the local rator.
trol Functions e
rlocks and Permissives e
1.3.2        Target Solution Preparation System TSPS is used to prepare uranyl sulfate target solution. PICS provides monitoring and ming functions for parameters associated with the TSPS preparation and dissolution tanks, uding alarms to alert the operators of potential overflow of the TSPS dissolution tank into the S glovebox. The TSPS is described in detail in Subsection 4b.4.2.2.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the TSPS dissolution tank l switches (Subsection 7.5.4.1.18).
PICS directly monitors and provides alarms for TSPS dissolution tank temperature and level cations, TSPS preparation tank temperature and level indications, and various additional tem temperatures and pressures.
ngle local control station is associated with the URSS and TSPS which is capable of laying these indications and alarms to the local operator.
PICS also provides alarms for automatic or manual Dissolution Tank Isolation described in section 7.5.3.1.
trol Functions PICS automatically controls the operation of the individual TSPS dissolution tank heaters ed on the associated TSPS dissolution tank temperature.
operator is able to use the PICS, either locally or remotely, to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.
NE Medical Technologies                    7.3-16                                      Rev. 4
 
PICS provides interlocks to:
* Prevent the operation of the TSPS filter pump when TSPS dissolution tank temperature is above an allowable limit.
* Stop or prevent from starting system pumps when discharge pressure is above an allowable limit or when the pump discharge flow path is isolated.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
1.3.3        Radioactive Drain System ins from vaults, trenches, and other areas where uranium-bearing solutions may be present part of the radioactive drain system (RDS), described in Subsection 9b.7.2. PICS is used to vide indication of leakage and the presence of liquid in the RDS sump tanks to alert the rator of abnormal situations.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the RDS liquid detection ches (Subsection 7.5.4.1.9).
PICS directly monitors and provides alarms for RDS sump tank temperature and level.
trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from the RDS sump tanks to another manually selected tank using the VTS. The PICS ns and closes the appropriate system isolation valves based on feedback from VTS lift tank l switches and the RDS sump tank level indication to accomplish the solution transfer.
n-progress solution transfer sequence can be manually aborted by the operator.
operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.
rlocks and Permissives PICS provides interlocks to prevent a vacuum transfer sequence from starting in the RDS p tanks when the temperature in the associated tank is above an allowable limit.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
NE Medical Technologies                    7.3-17                                      Rev. 4
 
ioactive liquid waste is stored in the radioactive liquid waste storage (RLWS), described in section 9b.7.4. The PICS is used to monitor tank levels and temperatures, control the ration of system valves, and provide functionality to support administrative controls related to transfer of radioactive liquid waste between tanks using the VTS.
nitoring and Alarms PICS monitors and provides alarms for two diverse methods of level indication for the vidual RLWS tanks, temperature indication for the individual RLWS tanks, and status dback from the mixers provided in the blending and collection tanks.
trol Functions en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from a selected RLWS tank to another manually selected tank using the VTS. The PICS ns and closes the appropriate system isolation valves based on feedback from VTS lift tank l switches and RLWS tank and destination tank level indication to accomplish the solution sfer.
n-progress solution transfer sequence can be manually aborted by the operator.
en manually initiated by the operator, the PICS executes a programmed sequence to obtain a ple from a manually selected RLWS tank. The PICS opens and closes the appropriate uum valves and sampling isolation valves to accomplish the sampling activity.
operator is able to use the PICS to manually open and close individual valves and manually t or stop individual components unless operation is prevented by interlocks, permissives, or ve sequences.
rlocks and Permissives PICS provides interlocks and permissives to:
* Prevent a vacuum transfer sequence from starting in a RLWS tank when the temperature in the associated tank is above an allowable limit.
* Prevent a vacuum transfer sequence from starting if the selected destination tank indicates level above an allowable limit.
* Allow tank solution transfers to the second uranium liquid waste tank or to the liquid waste blending tanks only when uranium sampling results have been entered and verified to be within allowable limits and when an operations supervisor has verified the results.
cation to the operator is provided on the PICS operator workstation displays when an rlock or permissive is bypassed.
NE Medical Technologies                      7.3-18                                        Rev. 4
 
ioactive liquid waste is immobilized in the RLWI system, described in detail in section 9b.7.3. PICS interfaces with the RLWI vendor-provided nonsafety-related control tem for monitoring purposes only.
nitoring and Alarms PICS directly monitors and provides alarms for RLWI immobilization feed tank level and perature and RLWI feed pump discharge pressure and flow rate.
RLWI control system directly monitors the status of immobilization drum filling and mixing ipment, and various other system parameters. The RLWI control system provides a subset of e monitored parameters and the status of the system to the PICS for display on the local and trol room PICS workstations for generation of alarms.
trol Functions RLWI control system is used by the local operator to manually start and stop operations to sfer drums into and out of the enclosure, and to fill and mix drums of liquid waste to be dified.
RWLI control system is also used by the operator to manually control RLWI enclosure n-process) functions.
en manually initiated by the operator, the PICS executes a programmed sequence to transfer tion from a selected RLWS tank to the immobilization feed tank as described in section 7.3.1.3.4.
rlocks and Permissives PICS provides an interlock to prevent the transfer of liquid waste into the RLWI enclosure ss the RLWI control system provides indication that it is in a ready status.
cation to the operator is provided on the PICS local and control room operator workstation lays when an interlock or permissive is bypassed.
1.3.6        Tritium Purification System TPS, which supplies tritium to the neutron drivers located in the IUs, is described in section 9a2.7.1. The TPS consists of three separate, identical trains. Train A serves IU s 1 and 2; Train B serves IU cells 3, 4, and 5; and Train C serves IU cells 6, 7, and 8.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for the IU cell (NDAS) target mber supply and exhaust pressures (Subsections 7.5.4.1.10 and 7.5.4.1.11), TPS exhaust to lity stack tritium (Subsection 7.5.4.1.12), and TPS confinement tritium bsection 7.5.4.1.13).
NE Medical Technologies                    7.3-19                                      Rev. 4
* Glovebox pressure, helium flow, and dew point;
* Target gas exhaust humidity;
* Nonsafety-related tritium concentration at various points in the system;
* Status feedback from TPS heaters; and
* Various other system pressures, temperatures, dew points, and flows.
PICS also provides alarms for automatic or manual TPS Train A/B/C Isolations and TPS cess Vent Actuations described in Subsection 7.5.3.1.
trol Functions en initiated by the operator, the PICS executes programmed sequences to start or stop a TPS
: n. The PICS opens and closes TPS valves to control the flow of gas through the TPS train and ween the separation columns. The PICS starts or stops pumps to transport process gas ugh the TPS and to circulate the TPS glovebox atmosphere. Temperature and pressure trol loops, listed below, are also enabled and disabled as applicable as part of the grammed sequence.
PICS provides automatic temperature control of permeators, depleted uranium storage s, oxide and hydride beds, and other TPS components by energizing and deenergizing the ter associated with each component.
PICS provides automatic temperature control of cryopumps and separation columns by trolling the position of liquid nitrogen supply valves and energizing or deenergizing the heater ociated with each component.
PICS provides control of glovebox pressures by opening and closing valves to add helium to glovebox or remove glovebox atmosphere to the zone 1 ventilation system.
en initiated by the operator, the PICS executes programmed sequences to start or stop gas ply to an individual NDAS unit. As part of the sequence, automatic control of valve positions is bled and disabled to maintain gas supply flow to each NDAS unit individually as selected by operator, and controls gas return flow pressure within an allowable pressure band.
en initiated by the operator, the PICS executes programmed sequences to perform other odic or maintenance tasks, including the addition of tritium from a depleted uranium storage to the process by energizing or deenergizing heaters, and the evacuation of process lines.
operator is able to use the PICS, either locally or remotely, to manually open and close vidual valves and manually start or stop individual components unless operation is prevented nterlocks, permissives, or active sequences. Components that are capable of being actuated TRPS or ESFAS are controlled by PICS as described in Subsection 7.3.1.3.11.
rlocks and Permissives PICS provides an interlock to prevent the introduction of tritium to an NDAS target chamber n the associated IU is not in Mode 2.
NE Medical Technologies                    7.3-20                                      Rev. 4
 
1.3.7        Stack Release Monitoring System stack release monitoring system (SRMS) consists of a stack release monitor (SRM) and a bon delay bed effluent monitor (CDBEM) to monitor gaseous effluents from the main duction facility. The SRMS is described in Subsection 7.7.5.
nitoring and Alarms PICS provides monitoring and alarms for SRM noble gas activity, pressure, flow, and mass rate, and CDBEM noble gas activity and mass flow rate.
trol Functions e
rlocks and Permissives e
1.3.8        Radiation Area Monitoring System radiation area monitoring system (RAMS) provides radiation monitoring within the main duction facility where personnel may be present and radiation levels could become ificant, as described in Subsection 7.7.3.
nitoring and Alarms PICS provides monitoring and alarms for the radiation level associated with each RAMS
. The PICS additionally provides alarms for communication errors and loss of power for each MS unit.
trol Functions e
rlocks and Permissives e
1.3.9        Continuous Air Monitoring System continuous air monitoring system (CAMS) provides airborne radiation monitoring within the n production facility, either alpha and beta activities for airborne particulates or beta activities airborne tritium, as described in Subsection 7.7.4.
NE Medical Technologies                    7.3-21                                          Rev. 4
 
PICS provides monitoring and alarms for the contamination level associated with each MS unit. The PICS additionally provides alarms for communication errors and loss of power each CAMS unit.
trol Functions e
rlocks and Permissives e
1.3.10      Quality Control and Analytical Testing Laboratory main production facility contains two laboratories to provide analytical testing support as cribed in Subsection 9b.5.4.
nitoring and Alarms PICS monitors and provides alarms for fume hood air flow rates.
trol Functions e
rlocks and Permissives e
1.3.11      Target Solution Vessel Reactivity Protection System and Engineered Safety Features Actuation System TRPS and ESFAS are the safety-related control systems for the main production facility, as cribed in Sections 7.4 and 7.5, respectively.
ety-related radiation monitors are also within the scope of the TRPS and ESFAS, as cribed in Subsection 7.7.1. These components are used to monitor radiation in the ological ventilation (RV) system and are discussed in Subsection 7.3.1.4.5 nitoring and Alarms PICS receives input from the TRPS and ESAFS and provides alarms related to the status functionality of the safety-related control systems (e.g., communication errors, faulted dules, failed power supplies).
NE Medical Technologies                    7.3-22                                        Rev. 4
 
PICS provides signals to the TRPS and ESFAS to provide normal control of components are capable of being actuated by TRPS or ESFAS. Control signals from the PICS are only epted by the TRPS and ESFAS when the associated enable nonsafety switch located on the n control board is in the enable position. Details of the control signals provided by PICS are cribed in Subsections 7.4.3.4 and 7.5.3.3.
rlocks and Permissives e
1.4          Other Facility Systems PICS provides the automated control and operator interface to manually control aspects of facility auxiliary and electrical systems.
1.4.1        Normal Electrical Power Supply System normal electrical power supply system (NPSS) is the normal electrical power supply for the NE facility, as described in Subsection 8a2.1.3. The NPSS provides normal power to the S, and the PICS provides monitoring, control, and alarms for the NPSS as described in this tion.
PICS remains operational through the use of local PICS power supplies upon a loss of site power for a minimum of 10 minutes (Subsection 7.3.3.6).
nitoring and Alarms PICS provides monitoring and alarms for voltage, current, frequency, and power for each n electrical service branch for the SHINE facility. The PICS additionally provides status cation (closed, open, or trip) and alarms for main service breakers, switchgear breakers, and reakers, as well as safety-related equipment breakers (i.e., NDAS HVPS breakers, VTS uum pump breakers, MEPS extraction pump breakers, and RVZ1 exhaust subsystem Z1e] exhaust, RVZ2 exhaust subsystem [RVZ2e] exhaust, and RVZ2 supply subsystem Z2s] supply fan breakers), and alarms for main service breaker undervoltage, overvoltage, se reversal, loss of phase, out of frequency, or loss of utility power.
trol Functions PICS provides the operator the ability to manually open or close the main service breakers, reakers, switchgear breakers, and the NDAS HVPS breakers.
PICS automatically disconnects the on-site electric power systems from the utility by ning the affected main service breaker on undervoltage, overvoltage, phase reversal, or loss hase.
NE Medical Technologies                    7.3-23                                        Rev. 4
 
PICS provides interlocks to prevent a main service breaker and the tie breaker for that same vice from being closed simultaneously, to prevent paralleling two AC power sources.
1.4.2        Uninterruptible Electrical Power Supply System uninterruptible electrical power supply system (UPSS) provides safety-related power for the n production facility, as described in Subsection 8a2.2.3.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for UPSS loss of external power bsection 7.5.4.1.19).
PICS directly monitors and provides alarms for battery room and UPS equipment room peratures, battery room hydrogen concentration, battery charge level, battery charger ent, inverter bypass status, inverter current, and various other system parameters for both sions of the UPSS. The PICS also provides alarms for fault conditions of UPSS components
., battery fault, battery charger fault, UPS fault, DC bus ground) and unexpected system nments (e.g., battery charger breakers open, bypass transformer breakers open, inverter ass breaker closed, load breakers open).
trol Functions e
rlocks and Permissives e
1.4.3        Standby Generator System SGS provides nonsafety-related backup power for the SHINE facility, as described in section 8a2.2.6. The SGS generator includes a vendor-provided nonsafety-related controller.
nitoring and Alarms PICS provides monitoring and alarms for SGS voltage, current, and power. The internal dor-provided SGS generator controller additionally monitors for generator status and faults, uding oil pressure, water temperature, engine temperature, fuel pressure, coolant level, rcrank or overspeed conditions, and other generator parameters. The SGS controller vides a subset of these monitored parameters to the PICS for display and alarming.
trol Functions PICS provides the operator the ability to manually start or stop the generator by providing a al to the SGS automatic transfer switch(es), and to manually transfer loads between the erator and the off-site utility by opening and closing breakers.
NE Medical Technologies                    7.3-24                                      Rev. 4
 
rlocks and Permissives generator automatic transfer switch design prevents paralleling the generator with either vice entrance.
1.4.4        Nitrogen Purge System N2PS provides a backup supply of sweep gas to each IU and to all tanks normally ventilated he PVVS during a loss of normal power or loss of normal sweep gas flow. The off-gas ulting from the nitrogen purge is treated by passive PVVS equipment prior to being harged to the stack. The N2PS is described in Subsections 6b.2.3 and 9b.6.2.
nitoring and Alarms PICS monitors and provides alarms for N2PS storage tube pressures, N2PS flows, and gen concentration in the N2PS structure general area.
PICS also provides alarms for automatic or manual IU Cell Nitrogen Purge and RPF ogen Purge described in Subsection 7.5.3.1.
trol Functions operator is able to use the PICS to manually open and close individual valves that are able of being actuated by TRPS or ESFAS, as described in Subsection 7.3.1.3.11.
rlocks and Permissives e
1.4.5        Radiological Ventilation Systems RV systems are constant volume systems that include supply air, recirculating, and exhaust systems required to condition the air and provide the confinement and isolation needed to gate design basis accidents, as described in Section 9a2.1. The main production facility uses e ventilation zones and five subsystems in the radiologically controlled area (RCA) to ntain the temperature and humidity of the RCA and to maintain a pressure gradient from as of least potential for contamination to areas with the most potential for contamination:
* RVZ1
* RVZ1 recirculating subsystem (RVZ1r)
* RVZ1e
* RVZ2
* RVZ2e
* RVZ2s NE Medical Technologies                    7.3-25                                      Rev. 4
 
RV systems interface with the vendor-provided building automation system.
nitoring and Alarms PICS receives input from the ESFAS and provides alarms for RVZ1 and RVZ2 RCA exhaust ation (Subsection 7.5.4.1.1), RVZ1 supercell radiation in all 10 supercell areas bsection 7.5.4.1.2 through Subsection 7.5.4.1.5), and RVZ1e IU cell radiation for each IU bsection 7.4.4.1.5).
building automation system continuously monitors hot water supply and return peratures, chilled water supply and return temperatures, unit mixed air temperature, and harge air temperature for the RVZ2s air handling units. The building automation system also nitors system flow rates and various other system parameters. The building automation tem provides a subset of the monitored variables to PICS for display and alarming.
PICS directly monitors and provides alarms for:
* RVZ1r IU cell and TOGS cell flows, temperatures, differential pressures, and status feedback from blowers,
* RVZ1e filter bank differential pressures and status feedback from blowers,
* RVZ2e filter bank differential pressures and status feedback from blowers,
* RVZ2r area temperatures, and status feedback from blowers and fans, and
* RVZ3 differential pressures.
PICS also provides alarms for automatic or manual Supercell Isolation and RCA Isolation cribed in Subsection 7.5.3.1.
trol Functions en manually initiated by the operator, the building automation system provides automatic trol of RVZ2s air handling units, RVZ1e and RVZ2e exhaust fans, make-up air supply, and position of dampers to maintain the air pressure cascade from areas with the least potential contamination (RVZ3) to the areas with the most potential for contamination (RVZ1). The ding automation system controls supply air temperature and humidity by modulating the ition of hot water heating and chilled water-cooling control valves.
en manually initiated by the operator, the PICS executes a programmed sequence to start or the RVZ1r subsystem for a selected IU by verifying dampers are in the correct position and bling or disabling RVZ1r automatic temperature control. The PICS maintains temperature in an allowable band by controlling the position of RPCS cooling water valves for the RVZ1r handling units.
en manually initiated by the operator, the PICS executes a programmed sequence to start or the RVZ1e subsystem by verifying dampers are in the correct position and enabling or bling RVZ1e automatic pressure control. The PICS maintains pressure within an allowable d by controlling the operation of the variable speed RVZ1e blowers.
NE Medical Technologies                    7.3-26                                      Rev. 4
 
bling RVZ2r automatic temperature control. The PICS maintains temperatures within an wable band by controlling the position of RPCS cooling water valves for the RVZ2r air dling units starting and stopping the RVZ2r RPCS pumps.
operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences. The operator may also use the PICS to manually open close individual valves and dampers and manually start or stop individual components ctly controlled by the PICS unless operation is prevented by interlocks, permissives, or active uences. Components that are capable of being actuated by TRPS or ESFAS are controlled PICS as described in Subsection 7.3.1.3.11.
rlocks and Permissives PICS provides interlocks and permissives to prevent operation of fans or blowers where the ociated discharge damper is closed.
1.4.6        Facility Ventilation System facility ventilation system (FVZ4) is a variable air volume system that provides heating, tilation, and cooling to the non-RCAs of the main production facility, as described in tion 9a2.1. FVZ4 interfaces with the vendor-provided building automation system.
nitoring and Alarms building automation system continuously monitors hot water supply and return peratures, chilled water supply and return temperatures, unit mixed air temperature, and harge air temperature for the RVZ2s air handling units. The building automation system also nitors system flow rates and various other system parameters. The building automation tem provides a subset of the monitored variables to PICS for display and alarming.
trol Functions en manually initiated by the operator, the building automation system provides automatic trol of FVZ4 air handling units, exhaust fans, make-up air supply, and the position of pers. The building automation system controls supply air temperature and humidity by dulating the position of hot water heating and chilled water-cooling control valves, or when door conditions allow for free cooling, by adjusting the percentage of outside air supplied as ke-up.
operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences.
rlocks and Permissives e
NE Medical Technologies                    7.3-27                                      Rev. 4
 
FCHS includes air cooled chillers and distribution pumps and provides chilled water to the n production facility RVZ2s and FVZ4 supply air handling units. The FCHS is described in section 9a2.1.3. FCHS interfaces with the vendor-provided building automation system.
nitoring and Alarms building automation system continuously monitors and provides alarms leaving chilled water peratures of chillers, return chilled water temperature, chiller flow rates, system pressure, and trol valve positions. The building automation system provides a subset of the monitored ables to PICS for display and alarming in the facility control room.
trol Functions en manually initiated by the operator, the building automation system provides automatic trol of the FCHS temperature. Each FCHS chiller is provided with an integral controller that trols onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the chiller. If temperature requirements are not
, the building automation system enables or disables redundant chillers as necessary to ntain FCHS temperature.
building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum chiller flow rates while ntaining real-time response to air handling unit load changes.
rlocks and Permissives e
1.4.8        Facility Heating Water System FHWS includes boilers and distribution pumps and provides heating water to the main duction facility RVZ2s and FVZ4 supply air handling units and to various terminal hot water
: s. The FHWS is described in Subsection 9a2.1.4. FHWS interfaces with the vendor-provided ding automation system.
nitoring and Alarms building automation system continuously monitors and provides alarms for leaving hot water peratures of boilers, return hot water temperature, hot water flow rates, and control valve itions. The building automation system provides a subset of the monitored variables to PICS display and alarming in the facility control room.
trol Functions en manually initiated by the operator, the building automation system provides automatic trol of the FHWS temperature. Each FHWS boiler is provided with an integral controller that trols onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the boiler. If temperature requirements are not NE Medical Technologies                      7.3-28                                        Rev. 4
 
building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum boiler flow rates while ntaining real-time response to connected load changes.
rlocks and Permissives e
1.4.9      Radioisotope Process Facility Cooling Water System RPCS includes a heat exchanger cooled by the PCHS and primary RPCS distribution ps, and provides cooling to various main production facility loads as described in tion 5a2.3. RPCS interfaces with the vendor-provided building automation system.
nitoring and Alarms building automation system continuously monitors and provides alarms for leaving chilled er temperature from the RPCS heat exchanger, return chilled water temperature, system flow s, system pressure, and control valve positions. The building automation system provides a set of the monitored variables to PICS for display and alarming in the facility control room.
trol Functions en manually initiated by the operator, the building automation system maintains RPCS heat hanger flow within an allowable band by enabling and disabling the primary RPCS distribution ps and controlling the position of RPCS valves.
operator is able to use the PICS to provide limited start and stop commands to building omation system control sequences.
rlocks and Permissives e
1.4.10      Process Chilled Water System PCHS includes air cooled chillers and distribution pumps and provides chilled water to the CS heat exchanger. The PCHS is described in Section 5a2.4. PCHS interfaces with the dor-provided building automation system.
nitoring and Alarms building automation system continuously monitors and provides alarms for leaving chilled er temperatures of chillers, return chilled water temperature, chiller flow rates, system ssure, and control valve positions. The building automation system provides a subset of the nitored variables to PICS for display and alarming in the facility control room.
NE Medical Technologies                    7.3-29                                        Rev. 4
 
en manually initiated by the operator, the building automation system provides automatic trol of the PCHS temperature. Each PCHS chiller is provided with an integral controller that trols all onboard operations (e.g., capacity control and safeties) and requires a signal from ding automation system to engage or disable the chiller. If temperature requirements are not
, the building automation system enables or disables redundant chillers as necessary to ntain PCHS temperature.
building automation system provides automatic control to enable and disable primary pumps equired to maintain loop flow rates between minimum and maximum chiller flow rates while ntaining real-time response to changes in RPCS heat exchanger load.
rlocks and Permissives e
1.4.11        Facility Nitrogen Handling System FNHS provides gaseous and liquid nitrogen to various systems in the main production lity, as described in Subsection 9b.7.8. The FNHS unit contains an integral vendor-provided troller.
nitoring and Alarms PICS provides monitoring and alarms for main production facility general area oxygen centration and nitrogen pressure in nitrogen receivers for end users.
FNHS unit contains an integral controller that monitors system status (e.g., vaporizer status tank level) and provides a subset of monitored parameters to the PICS for display and ming.
trol Functions operator is able to use the PICS to provide limited start and stop commands to the FNHS gral controller and to manually open and close individual valves.
rlocks and Permissives e
1.4.12        Facility Chemical Reagent System portion of the facility chemical reagent system (FCRS) that interfaces with the PICS provides eous oxygen to the TOGS, as described in Subsection 9b.7.10 nitoring and Alarms PICS provides monitoring and alarms for pressure in oxygen receivers for end users.
NE Medical Technologies                      7.3-30                                      Rev. 4
 
e rlocks and Permissives e
1.4.13      Facility Demineralized Water System FDWS provides demineralized water to various systems in the main production facility as cribed in Section 5a2.6. The FDWS RO unit contains an integral vendor-provided controller.
nitoring and Alarms FDWS RO unit contains an integral controller that monitors system status (e.g., storage tank l) and provides a subset of monitored parameters to the PICS for display and alarming.
trol Functions operator is able to use the PICS to provide limited start and stop commands to the RO unit gral controller and to manually open and close individual valves.
rlocks and Permissives e
1.4.14      Seismic Monitoring System PICS contains a seismic monitoring system, which includes instrumentation, control inets, and a dedicated computer for monitoring seismic activity in the safety-related portion of facility. The seismic monitoring system provides event recording time histories for seismic nts and provides indication of a seismic event to the PICS for alarm in the facility control
: m. Data may be retrieved from the seismic monitoring system by either the dedicated puter or via the operator workstation in the facility control room.
nitoring and Alarms PICS provides monitoring and alarms for the acceleration status of the seismic monitors ted in the main production facility.
trol Functions e
rlocks and Permissives e
NE Medical Technologies                      7.3-31                                      Rev. 4
 
SHINE facility design criteria applicable to the PICS are stated in Table 3.1-2. The facility ign criteria applicable to the PICS, and the PICS system design criteria, are addressed in this tion. Discussion of other vendor-provided nonsafety-related control systems is also provided, re applicable.
2.1        SHINE Facility Design Criteria NE facility design criterion 13 applies to the PICS.
SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
PICS interfaces with the safety-related TRPS, ESFAS, NFDS, and safety-related radiation nitors to provide nonsafety-related system status and measured process variable values for wing, recording, and trending. The TRPS, ESFAS, NFDS, and safety-related radiation nitors and applicable operating ranges are described in Sections 7.4, 7.5, 7.7, and 7.8. The S is designed to operate in a normal environment and during normal radiological conditions bsection 7.3.3.3).
2.2        PICS System Design Criteria 2.2.1      Access Control PICS Criterion 1 - The PICS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.
PICS and other vendor-provided nonsafety-related control systems do not allow remote ess and include the capability to disable unneeded networks, communication ports, and ovable media drives or provide engineered barriers (Subsection 7.3.3.5). Physical access to SHINE facility is controlled in accordance with the physical security plan. Physical access to control room and access to the equipment within is controlled as described in section 7.6.3.4.
2.2.2      Software Requirements Development PICS Criterion 2 - A structured process, which is commensurate with the risk associated with its failure or malfunction and the potential for the failures challenging safety systems, shall be used in developing software for the PICS.
NE Medical Technologies                    7.3-32                                        Rev. 4
 
vided nonsafety-related control systems is also described in Subsection 7.3.3.4.
PICS Criterion 3 - The PICS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address verification and validation (V&V) and configuration control activities.
PICS is developed in accordance with the PICS validation master plan, which addresses V and configuration control activities, as described in Subsection 7.3.3.4. The development of er vendor-provided nonsafety-related control systems is also described in Subsection 7.3.3.4.
PICS Criterion 4 - The configuration control process shall assure that the required PICS hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.
PICS validation master plan assures that the required PICS hardware and software are alled in the appropriate system configuration and ensures that the correct version of the dware/firmware is installed in the correct hardware components as described in section 7.3.3.4. Configuration control of other vendor-provided nonsafety-related control ems is also described in Subsection 7.3.3.4.
2.2.3      Fail Safe PICS Criterion 5 - The PICS shall assume a defined safe state with loss of electrical power to the PICS.
mponents controlled by the PICS assume a defined safe state on loss of electrical power bsection 7.3.3.6).
2.2.4      Effects of Control System Operation/Failures PICS Criterion 6 - The PICS shall be designed so that it cannot fail or operate in a mode that could prevent the TRPS or ESFAS from performing its designated functions.
safety-related PICS inputs into the TRPS and ESFAS are designed and controlled so they do prevent the TRPS or ESFAS from performing its safety functions as described in sections 7.4.3.4 and 7.5.3.3. Other vendor-provided nonsafety-related control systems do provide input to the TRPS or ESFAS.
2.2.5        Operational Bypass PICS Criterion 7 - Bypasses of PICS interlocks, including provisions for testing, shall be under the direct control of a control room operator and shall be indicated on control room displays.
assing of interlocks is performed from the PICS workstations under the direct control of the trol room operator. Bypassing an interlock generates a notification that is visible on the PICS kstation displays (Subsection 7.3.4.2). Interlocks applicable to each system served by the S are described in Subsection 7.3.1.
NE Medical Technologies                    7.3-33                                        Rev. 4
 
PICS Criterion 8 - Subsystems of and equipment in the PICS shall be designed to allow testing, calibration, and inspection to ensure functionality.
ting, calibration and inspection of PICS equipment are allowable to ensure functionality as cribed in Subsection 7.3.4.2.
PICS Criterion 9 - Testing, calibration, and inspections of the PICS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.
ting, calibration, and inspection of PICS equipment are described in Subsection 7.3.4.2.
3        DESIGN BASIS 3.1          Design Basis Functions PICS is designed to allow the operator to perform irradiation cycles, transfer target solution nd from the IU as well as through the main production facility, and interface with the TPS, ercell, waste handling, and auxiliary systems, as described in Subsection 7.3.1.
PICS contains no safety-related controls and has no safety-related functions; however, the ty-related TRPS, ESFAS, NFDS, and safety-related radiation monitors provide nonsafety-ted system status and measured process variable values to the PICS for viewing, recording, trending. The PICS is also used to transmit discrete hardwired signals to the TRPS and FAS for deliberate operator action to return the TRPS or ESFAS to a normal operating state.
3.2          Modes of Operation modes of operation for the functions of the PICS that interface with individual IUs correspond he mode of that IU (see Subsection 7.3.1). Portions of the PICS that monitor or control mon or facility-wide systems are not mode-dependent.
3.3          Operating Conditions PICS control cabinets are located in the non-RCAs of the main production facility and PICS ponents are in various plant areas with varying environmental conditions. The PICS is igned for the normal environmental and radiological conditions provided in Tables 7.2-1 ugh 7.2-6.
3.4          Software Development PICS is developed under a structured process commensurate with the risk associated with ailure or malfunction and the potential for challenging safety systems. The process for elopment of the PICS includes the definition of functional requirements, a documented elopment and implementation process, and a plan for verification of software outputs.
PICS software development lifecycle process requirements, including V&V and configuration trol requirements to ensure that hardware and software are installed in the appropriate NE Medical Technologies                    7.3-34                                        Rev. 4
 
dation master plan additionally includes provisions for operational qualification testing to fy the operation and functionality of various aspects of the PICS, including operator graphics uracy and functionality, security, interface communications, interlock functionality, and control c operation and failure monitoring and handling.
dor-provided nonsafety-related control systems are developed under structured processes mensurate with the risk associated with their failure or malfunction and the potential for llenging safety systems.
process for development of the NDAS control system includes the definition of functional uirements, a documented development and implementation process, and a plan of fication of software outputs. The NDAS control system software development lifecycle cess requirements, including V&V and configuration control requirements to ensure that dware and software are installed in the appropriate system configuration and ensure that the ect version of the software/firmware is installed in the correct hardware components, are cribed in the NDAS vendor software quality assurance plan.
h the PICS and NDAS control systems are subject to acceptance by SHINE as part of factory eptance testing, site acceptance testing, and system turnover processes.
er vendor-provided nonsafety-related control systems, which include the building automation tem, the supercell control system, and the RLWI control system, are independently developed he vendor, and accepted by SHINE as part of factory acceptance testing, site acceptance ing, and system turnover.
3.5        Access Control and Cyber Security PICS and other vendor-provided nonsafety-related control systems do not use the secure elopment and operating environment implemented for the safety-related control systems cribed in Subsection 7.4.5, but rather incorporate features commensurate with the risk and gnitude of the harm that would result from unauthorized and inappropriate access, use, losure, disruption, or destruction of this nonsafety-related control system.
PICS and other vendor-provided nonsafety-related control systems do not allow remote ess. Remote access is defined as the ability to access the components of the operator kstations, main control board, PICS display cabinet, and other PICS controllers and cabinets a location with less physical security.
PICS and other vendor-provided nonsafety-related control systems include the capability to ble, through software or physical disconnection, unneeded networks, communication ports, removable media drives, or provide engineered barriers.
PICS and other vendor-provided nonsafety-related control systems do not use any wireless rface capabilities for control functions.
PICS provides information to the facility data and communications system (FDCS) networks equipment via a one-way data diode, such that no inputs can be provided to the PICS from site sources.
NE Medical Technologies                    7.3-35                                        Rev. 4
 
urity requirements imposed on the PICS during the development phase are commensurate the risk and magnitude of the harm that would result from unauthorized and inappropriate ess, use, disclosure, disruption, or destruction. Security requirements for the PICS elopment include limiting access to the software to those individuals involved in the PICS elopment project.
urity requirements imposed on the vendor-provided nonsafety-related control systems during development phase are commensurate with the risk and magnitude of the harm that would ult from unauthorized and inappropriate access, use, disclosure, disruption, or destruction.
urity requirements for the NDAS control system include limiting access to the software to e individuals employed by the NDAS vendor and other individuals involved in the NDAS trol system development project.
special security requirements are imposed on the vendors for other nonsafety-related control tems, which include the building automation system, the supercell control system, and the WI control system, as these systems are not considered part of the control console and lay instruments.
3.6          Loss of Power PICS design includes local battery supplies sufficient to allow the PICS to continue to rate for at least 10 minutes after a loss of external power. The 10-minute design supports ting and loading the defense-in-depth SGS within five minutes following a loss of off-site er event (Section 8a2.2).
mponents controlled by the PICS assume a defined safe state on loss of electrical power.
4        OPERATION AND PERFORMANCE 4.1          System Operation PICS is designed to operate under normal facility conditions and anticipated transients to ure adequate safety for the facility.
4.2          Testing and Maintenance S initial hardware testing is performed in accordance with the PICS validation master plan.
dware testing is to be performed on the control cabinets, the localized I/O cabinets and the I panels, the operator workstations, and the main control board.
design of the PICS allows operators to remove main control board or operator workstation lays from service without impacting the operation of the remaining portions of the PICS.
PICS is designed to allow testing, calibration, and inspection to ensure functionality, and udes features for failure detection and self-test capabilities.
NE Medical Technologies                    7.3-36                                        Rev. 4
 
PICS has in-service self-testing capabilities such that the system will alarm if individual ts or an entire rack or cabinet lose communications or faults.
h PICS analog I/O module has status indicators that display module status. The PICS analog modules allow for calibration on a channel-by-channel or module-wide basis.
safety-related interlocks are provided in the PICS as described in Subsection 7.3.1.
assing of interlocks is performed from the PICS workstations under the direct control of the trol room operator. Bypassing an interlock generates an alarm that is visible on the PICS kstation displays.
4.3          Technical Specifications and Surveillance PICS contains no safety-related controls and has no safety-related functions; however, the S monitors parameters and provides control room alarms.
tain material in this section provides information that is used in the technical specifications.
includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.
5        CONCLUSION PICS is designed to allow the operator to perform facility activities in a safe and efficient nner. The PICS contains no safety-related controls and has no safety-related functions; ever, the PICS interfaces with the safety-related TRPS, ESFAS, NFDS, and safety-related ation monitors to provide nonsafety-related system status and measured process variable es for viewing, recording, and trending. Other vendor-provided nonsafety-related control tems interface with the PICS as needed to allow the operator to monitor and control facility ipment.
PICS and other vendor-provided nonsafety-related control systems do not use the highly grated protection system (HIPS) design, but instead are developed under structured cesses commensurate with the risk associated with each systems failure or malfunction.
NE Medical Technologies                    7.3-37                                          Rev. 4
 
Chapter 7 - Instrumentation and Control Systems                                                                                                                                                                                                                                    Process Integrated Control System Figure 7.3 Process Integrated Control System Architecture Control Room                                                                                                                                                                          PLC Cabinet Safety    Supercell and      Ancillary      Utilities      IU Cells        IU Cells      IU Cells IU Cell #8      IU Cell #7 IU Cell #6 IU Cell #5      Facility    Facility    IU Cell #4  IU Cell #3      IU Cell #2    IU Cell #1                        Communication Target Solution  Equipment Overview        Overview  Overview  Overview        Process    Process      Overview    Overview        Overview      Overview                                PLC      Transfer PLC PLC            PLC          1-2 PLC        3-5 PLC      6-8 PLC Supervisor Workstation Server Cabinet NDAS Workstation                                                                                Operator Workstation Rack Mounted Switch NDAS Workstation                                                                                Operator Workstation Building                                    Seismic Supercell    RLWI Control Automation                                  Monitoring  FDWS Controls FNHS Controls Control System    System System                                      System NDAS Control System Key ESFAS - engineered safety features actuation system FDWS - facility demineralized water system FNHS - facility nitrogen handling system HC - hot cell IU - irradiation unit IXP - Iodine and xenon purification and packaging MEPS - molybdenum extraction and purification system                    Cabinet                    Cabinet                    Cabinet                      Cabinet IU  Cabinet IU Workstation MIPS - molybdenum isotope product packaging system                        TSSS                  TSSS/RLWS                    RPCS/NPSS                          Cell 7-8  Cell 1-4  RLWI Area N2PS - nitrogen purge system Cabinet                    Cabinet                  Cabinet UPSS/                  Cabinet IU  Cabinet IU NDAS - neutron driver assembly system                                      TSSS                  RSSS/RLWS                    ESFAS/TRPS                        Cell 5-6  Cell 5-8 Workstation NPSS - normal electrical power supply system Cabinet MEPS/                                                                        Supercell A PLC - programmable logic controller                                      Cabinet                                              Cabinet                        Cabinet IU    Cabinet IXP/MIPS/VTS/                                                                            Area PVVS                          HC                      N2PS                            Cell 3-4    RCA PVVS - process vessel vent system RCA - radiologically controlled area                                                                Cabinet                    Cabinet Cabinet                                                                              Cabinet IU              Workstation LABS/TSPS/
RDS - radioactive drain system                                            RDS                      URSS SGS                          Cell 1-2              Supercell B RLWI - radioactive liquid waste immobilization system                                                                                                                                    Area RLWS - radioactive liquid waste storage system RPCS - radioisotope process facility cooling system Workstation SGS - standby generator system TPS Train A I/O            TPS Train A I/O                  TPS Train A I/O                        Supercell C TPS - tritium purification system and PLC                      and PLC                          and PLC                              Area TRPS - target solution vessel reactivity protection system TS - target solution TSPS - target solution preparation system                                                                                                                                            Workstation TS Prep Area TSSS - target solution staging system UPSS - uninterruptible electrical power supply system Workstation                  Workstation                      Workstation TPS Area                    TPS Area                          TPS Area URSS - uranium receipt and storage system VTS - vacuum transfer system SHINE Medical Technologies                                                                                                                                                        7.3-38                                                                                                                                Rev. 4
 
1        SYSTEM DESCRIPTION target solution vessel (TSV) reactivity protection system (TRPS) is a safety-related rumentation and control (I&C) system consisting of eight independent instances, or systems, each dedicated to one of the eight irradiation units (IU) in the SHINE irradiation lity.
TRPS performs various design basis safety functions as required by the SHINE safety lysis described in Chapter 13 for accelerator-based irradiation processes taking place within h IU cell. While operating, the TRPS performs various detection, logic processing, control, actuation functions associated with the SHINE irradiation process. The TRPS includes t/output capabilities necessary to interface with various indications and control components ted within the facility control room. The TRPS also provides nonsafety-related system status measured process variable values to the process integrated control system (PICS) for wing, recording, and trending.
TRPS monitors variables important to the safety functions of the irradiation process during h operating mode of the IU to perform one or more of the following safety functions:
* IU Cell Safety Actuation
* IU Cell Nitrogen Purge
* IU Cell Tritium Purification System (TPS) Actuation
* Driver Dropout TRPS also performs the nonsafety defense-in-depth Fill Stop function.
TRPS monitors the IU cell from filling of the TSV through irradiation of the target solution, ping of the target solution, and transfer of the target solution to the radioisotope production lity (RPF). All advances to the modes of operation throughout the irradiation process are nually initiated by the operator and the TRPS implements the required mode-specific system rlocks and bypasses; however, the TRPS does not automatically determine the mode of ration. If at any point during the irradiation process a monitored variable indicating unsafe ditions exceeds its setpoint, the TRPS automatically places the IU into a safe state. The PS logic diagrams are shown in Figure 7.4-1.
TRPS uses redundant and independent sensors through three divisions to complete the cal decisions necessary to initiate the required protective trips and actuations. When a TRPS t channel exceeds a predetermined limit, the trip determinations from each division of the PS are sent to voting logic where a two-out-of-three coincident logic vote is performed to ate a trip or actuation. The general architecture of the TRPS is shown in Figure 7.1-2.
TRPS is designed using the highly integrated protection system (HIPS) platform, which is cribed in Subsection 7.4.5. TRPS equipment is separated into three divisions (A, B, and C).
TRPS redundantly receives safety-related inputs from field instrumentation (input devices) to er two divisions (A and B) or all three divisions, dependent on the input variable. The input als are provided to the TRPS safety function modules (SFMs) or, in the case of the TSV fill e position indication, to a hardwired module (HWM). More than one input device provides a al to each SFM. The inputs are allocated to the different SFMs (or HWM) within a division as NE Medical Technologies                      7.4-1                                        Rev. 4
 
ociated trip/bypass switch located below the SFM, as described in Subsection 7.4.4.3.
cing an SFM in trip or bypass causes all channels associated with that SFM to be placed in or bypass, respectively.
TRPS bypass logic is implemented in all three divisions using scheduling, bypass, and ng modules (SBVMs), for divisions A and B, or scheduling and bypass modules (SBMs), for sion C. The TRPS voting and actuation logic is implemented in only divisions A and B. For sions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs ny two of the three divisions determine that an actuation is required. Both TRPS divisions A B evaluate the input signals from the SFMs in each of three redundant SBVMs. Each SBVM pares the inputs received from the SFMs and generates an appropriate actuation signal if uired by two or more of the three divisions.
output of the three redundant SBVMs in divisions A and B is communicated via three pendent safety data buses to the associated equipment interface modules (EIMs). There are independent EIMs for each actuation component, associated with each division A and B of PS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of e signals agree on the need to actuate. Both EIMs associated with a component are required e deenergized for the actuation component(s) to fail to their actuated (deenergized) states.
2      DESIGN CRITERIA SHINE facility design criteria applicable to the TRPS are stated in Table 3.1-1. The facility ign criteria applicable to the TRPS, and the TRPS system design criteria, are addressed in section.
2.1        SHINE Facility Design Criteria generally-applicable SHINE facility design criteria 1 through 6 apply to the TRPS. The TRPS esigned, fabricated, and erected to quality standards commensurate to the safety functions to performed; will perform these safety functions during external events; will perform these ty functions within the environmental conditions associated with normal operation, ntenance, and testing; does not share components between irradiation units; and is able to manually initiated from the facility control room. These elements of the TRPS design tribute to satisfying SHINE facility design criteria 1 through 6.
NE facility design criteria 13 through 19, 38, and 39 also apply to the TRPS.
2.1.1        Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating range.
NE Medical Technologies                      7.4-2                                      Rev. 4
 
uracy for each variable, the response time, and the analytical limit. Subsection 7.4.4.1 vides a discussion of each of these variables, including details on how they are maintained in the prescribed operating range.
2.1.2        Protection System Functions SHINE Design Criterion 14 - The protection systems are designed to: (1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and (2) sense accident conditions and to initiate the operation of safety-related systems and components.
safety functions of the TRPS credited to maintain the acceptable target solution design limits ble 4a2.2-2) during anticipated transients are IU Cell Safety Actuation (Subsection 7.4.3.1.1),
Cell Nitrogen Purge (Subsection 7.4.3.1.2), and Driver Dropout (Subsection 7.4.3.1.4). The ary variables that are monitored to prevent exceeding the target solution design limits during cipated transients are the high time-averaged neutron flux (Subsection 7.4.4.1.3), high wide ge neutron flux (Subsection 7.4.4.1.4), high and low primary closed loop cooling system LS) temperature (Subsections 7.4.4.1.5 and 7.4.4.1.6), low PCLS flow bsection 7.4.4.1.7), low TSV off-gas system (TOGS) mainstream flow bsection 7.4.4.1.11), and high TOGS condenser demister outlet temperature bsection 7.4.4.1.13). There are no anticipated transients that would result in target solution ign limits being exceeded.
ration of the TRPS in response to the analyzed events is presented in Subsection 7.4.4.1.
section describes the parameters monitored to sense accident conditions and automatic tem response to actuation setpoints in monitored variables. Subsection 7.4.3.1 contains a cription of the TRPS safety functions relied upon for specific accident scenarios and onstrates that the TRPS is able to sense accident conditions and initiate the operation of ty-related systems and components.
2.1.3        Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.
Redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function, and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.
HIPS platform design for the TRPS supports high functional reliability, in part, by rporating predictability and repeatability principles to ensure an extremely high probability of omplishing safety functions, as described in Subsection 7.4.5.2.3. High functional reliability is her addressed in SHINE Design Criterion 19 (Subsection 7.4.2.1.7).
NE Medical Technologies                      7.4-3                                        Rev. 4
 
ctures, systems, and components that comprise a division are physically separated to retain capability of performing the required safety functions during a design basis accident bsection 7.4.5.2.1).
undancy within the TRPS, as described in Subsection 7.4.5.2.2, consists of three divisions of t processing and trip determination and two divisions of actuation logic arranged such that no le failure can prevent a safety actuation when required, and no single failure in a single asurement channel can generate an unnecessary safety actuation (Subsection 7.4.3.4). This validated by the performance of a single failure analysis of the TRPS, performed in ordance with Institute of Electrical and Electronics Engineers (IEEE) Standard 379-2000 E, 2000), as described in Subsection 7.4.5.2.2.
hannel of TRPS can be taken out of service by placing the channel in trip or using the ntenance bypass function, as described in Subsection 7.4.4.3. A channel can be taken to trip out an adverse impact on redundancy, as described in Subsection 7.4.4.3.
maintenance bypass function allows an individual safety function module to be removed service for up to two hours in accordance with the technical specifications, for the purpose erforming required technical specification surveillance testing (Subsection 7.4.4.3). A time t of two hours is acceptable based on the small amount of time the channel could be in ass, the continual attendance by operations or maintenance personnel during the test, the tinued operability of the redundant channel(s), and the low likelihood that an accident would ur during the two hour time period. By allowing a single SFM module to be placed in ntenance bypass in accordance with the technical specifications, technical specifications veillances can be performed to verify the operability of TRPS components during system ration, which supports in-service testability.
-test features are provided for components that do not have setpoints or tunable parameters.
discrete logic of the actuation and priority logic (APL) of the EIM does not have self-test ability but is instead functionally tested (Subsection 7.4.4.4). Calibration, testing, and nostics are addressed in Section 8.0 of Topical Report TR-1015-18653, Design of the hly Integrated Protection System Platform (NuScale, 2017). Self-testing capabilities provide cation of component degradation and failure, which allows action to be taken to ensure that ingle failure results in the loss of the protection function.
2.1.4        Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels, do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.
TRPS control and logic functions operate inside of the facility control room, where the ironment is mild, not exposed to the irradiation process, and is protected from earthquakes, adoes, and floods (Subsections 7.4.3.5 and 7.4.3.6). The TRPS structures, systems, and NE Medical Technologies                        7.4-4                                      Rev. 4
 
pendence is maintained throughout the design, extending from the sensor to the devices ating the protective function (Subsection 7.4.5.2.1).
ctional diversity and diversity in component design are used to prevent loss of the protection tion. Functional diversity is discussed in Subsection 7.4.5.2.5. Field programmable gate ys (FPGAs) in each division are of a different physical architecture to prevent common cause re (CCF) (Subsection 7.4.5.2.4).
2.1.5        Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.
trolled components associated with safety actuations are designed to go to their safe state n deenergized (Subsection 7.4.3.8). The TRPS equipment is qualified for radiological and ironmental hazards present during normal operation and postulated accidents bsection 7.4.3.5). A failure modes and effects analysis (FMEA) was performed which verified there are no single failures or non-detectable failures that can prevent the TRPS from orming its required safety function (Subsection 7.4.5.2.2).
2.1.6        Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.
sors with an output used to determine TRPS protective actions are safety-related and input ctly to the TRPS. The TRPS provides these sensor inputs to the PICS through redundant puts. After receiving the input from the TRPS, the PICS performs its control function, if one is ociated with the input. There are no inputs to the TRPS from the PICS that are used in the ermination of protective actions. Since there are no inputs from the PICS that impact a safety tion in the TRPS, and sensors that provide a safety-related protection function and a safety-related control function are routed directly to the TRPS, a failure or removal from vice of any single protection system component or channel that is common to the control and ection systems leaves intact a system satisfying the reliability, redundancy, and pendence requirements of the TRPS as described in Subsections 7.4.3.4, 7.4.4.3, 7.4.5.2.1, 5.2.2, and 7.4.5.2.3.
inputs to the TRPS that have both safety-related protection functions and nonsafety-related trol functions are TOGS oxygen concentration (Subsection 7.4.4.1.10) and TOGS nstream flow (Subsection 7.4.4.1.11). For each of these inputs, the nonsafety-related control ction is based upon the median value of the inputs to the TRPS (Subsection 7.3.1.1.2). Since median value is selected, a failure of a single input will not impact the control function.
NE Medical Technologies                      7.4-5                                          Rev. 4
 
section 7.4.3.4. A failure of these nonsafety-related inputs will not impede the TRPS from orming its safety function because the safety function is prioritized over the nonsafety-related t as described in Subsection 7.4.3.12. This limitation of inputs, and the prioritization of the ty function, ensures that interconnection of the TRPS and PICS is limited to assure that ty is not significantly impaired.
2.1.7        Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.
application of the HIPS platform to the TRPS ensures an extremely high probability of omplishing the required safety functions by applying the attributes of independence, undancy, and predictability and repeatability. Collectively, these attributes ensure the TRPS tions in a highly consistent manner with high reliability. Independence principles contribute to uring an extremely high probability of accomplishing safety functions by ensuring that ctures, systems, and components that comprise a division are physically separated.
ependence is further described in Subsection 7.4.5.2.1. Redundancy principles contribute to uring an extremely high probability of accomplishing safety functions by ensuring that no le failure can prevent a safety actuation, as described in Subsections 7.4.3.4 and 7.4.5.2.2.
dictability and repeatability principles contribute to ensuring an extremely high probability of omplishing safety functions by ensuring the TRPS produces the same outputs for a given set put signals within well-defined response time limits. Predictability and repeatability is further cribed in Subsection 7.4.5.2.3.
2.1.8        Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
TRPS monitors for potential radioactivity releases from the primary confinement boundary monitoring radiological ventilation zone 1 exhaust subsystem (RVZ1e) IU cell radiation, as cribed in Subsection 7.4.4.1.15. Additional radioactivity release monitoring is provided by the ineered safety features actuation system (ESFAS) (Section 7.5) and by nonsafety-related ation monitoring systems (Section 7.7). The radiation release monitoring provided by the PS, ESFAS, and nonsafety-related radiation monitoring systems provides monitoring for ential effluent discharge paths and plant environs that may be released from normal rations, including anticipated transients, and from postulated accidents.
2.1.9        Hydrogen Mitigation SHINE Design Criterion 39 - Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries is maintained.
NE Medical Technologies                      7.4-6                                          Rev. 4
 
low TOGS mainstream flow signal protect against a deflagration in the primary system ndary (Subsections 7.4.4.1.10 and 7.4.4.1.11). The low TOGS dump tank flow signal protects inst a deflagration in the TSV dump tank (Subsection 7.4.4.1.12).
2.2          TRPS System Design Criteria 2.2.1        Access Control TRPS Criterion 1 - The TRPS shall require a key or combination authentication input at the control console to prevent unauthorized use of the TRPS.
TRPS utilizes a HIPS design which is described in Subsection 7.4.5. Unauthorized use of TRPS is prevented by required use of a physical key as described in Subsection 7.4.5.3.3.
TRPS Criterion 2 - Developmental phases for TRPS software shall address the potential cyber security vulnerabilities (physical and electronic) to prevent unauthorized physical and electronic access.
TRPS development design uses the process described in Subsection 7.4.5.3.1 to prevent uthorized physical and electronic access.
TRPS Criterion 3 - The TRPS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.
ess control features prevent unauthorized physical and electronic access to CDAs during the rational phase and during transition from development to operations. Access control, cyber urity, and the secure development operating environment are described in section 7.4.5.3. Subsection 7.4.5.3 describes prevention of unauthorized access during the elopment and operational phases. Post-development installation and testing is performed controlled by the safety-related control system vendor as described in section 7.4.5.4.2.6.
2.2.2        Software Requirements Development TRPS Criterion 4 - The functional characteristics of the TRPS software requirements specifications shall be properly and precisely described for each software requirement.
programmable logic design requirements are specified in the programmable logic uirements specifications (PLRS), which are generated in accordance with the vendor grammable logic development lifecycle process (Subsection 7.4.5.4.2). A programmable logic ign specification (PLDS) is generated to define the programmable logic design details.
grammable logic development is addressed in Subsection 7.4.5.4.
TRPS Criterion 5 - Development of TRPS software shall follow a formally defined lifecycle process and address potential security vulnerabilities in each phase of the lifecycle.
NE Medical Technologies                    7.4-7                                        Rev. 4
 
cess addresses security vulnerabilities (physical and electronic) in the developmental phases he software and addresses controls to prevent unauthorized physical and electronic access.
grammable logic lifecycle activities are performed within a secure development environment E) using an isolated development network (IDN) (Subsections 7.4.5.3.1 and 7.4.5.4.2.2).
TRPS Criterion 6 - TRPS development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the TRPS.
grammable logic lifecycle activities necessitate use of a SDE using an IDN from the uirements Phase forward (Subsection 7.4.5.4.2.2). Software requirements development, uding lifecycle phase-specific security requirements, is addressed in TRPS Criterion 5.
TRPS Criterion 7 - TRPS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address safety analysis, verification and validation (V&V), and configuration control activities.
programmable logic lifecycle process for the TRPS includes development of a grammable Logic Development Plan (PLDP), V&V Plan, and Configuration Management n to control programmable logic development and its associated safety analysis, V&V, and figuration management activities (Subsection 7.4.5.4.2.1).
TRPS Criterion 8 - Tasks for validating and verifying the TRPS software development activities shall be carried out in their entirety. Independent V&V shall be performed by individuals or groups with appropriate technical competence in an organization separate from the development and program management organizations. Successful completion of V&V tasks for each software lifecycle activity group shall be documented.
NE has delegated V&V activities related to the safety-related control system development, uding V&V documentation, to the vendor. The vendor Project V&V Plan for the system elopment was tailored and adapted for FPGA technology from the guidance in IEEE ndard 1012-2004 (IEEE, 2004a). The V&V activities are performed using an internal V&V m from within the design organization (Subsection 7.4.5.4.5).
TRPS Criterion 9 - The TRPS software lifecycle configuration control program shall trace software development from software requirement specification to implementation and address any impacts on TRPS safety, control console, or display instruments.
programmable logic lifecycle process includes development of a Configuration Management n (Subsection 7.4.5.4.6) to control tracing of programmable logic development from uirements specifications to implementation and address any impacts on TRPS programmable c functions. The configuration control process as it relates to control consoles and display ruments, which are part of the nonsafety-related PICS, is described in Subsection 7.6.2.2.2.
SHINE configuration management program will ensure consistency among the design uirements between TRPS and PICS.
NE Medical Technologies                      7.4-8                                    Rev. 4
 
ensure that the correct version of the software/firmware is installed in the correct hardware components.
section 7.4.5.4.6.3 addresses compliance with TRPS Criterion 10 and ensures the correct sion of software/firmware is installed in the correct hardware components. The development se configuration management process is described in Subsection 7.4.5.4.6.1 and states that ponents of the system (hardware) and programmable logic and its development process a (software) are controlled by the Project Configuration Management Plan. Post-installation se configuration management is addressed in Subsection 7.4.5.4.6.2.
TRPS Criterion 11 - Validation testing shall test all portions of TRPS programmable logic necessary to accomplish its safety functions and shall exercise those portions whose operation or failure could impair safety functions during testing.
lementation phase V&V activities, described in Subsection 7.4.5.4.5.5, verify the design uracy to accomplish safety functions and include functional verification and timing verification vities. Test phase V&V (Subsection 7.4.5.4.5.6) includes system functional, interface, and ormance testing.
TRPS Criterion 12 - The TRPS software development lifecycle shall include a software risk management program which addresses vulnerabilities throughout the software lifecycle.
vendor utilizes a Project Risk Management Plan for development of the TRPS, as described ubsection 7.4.5.4.8. Risk identification activities occur throughout the project lifecycle.
ntified risks are documented in a project risk register and actions are developed to address tified risks or vulnerabilities.
TRPS Criterion 13 - TRPS equipment not designed under a SHINE approved quality assurance (QA) program shall be accepted under the SHINE commercial-grade dedication program.
developmental process for creating the safety-related TRPS has been delegated to SHINE's ty-related control system vendor (Subsection 7.4.5.3.1), including any modifications to the tem logic after initial development (Subsection 7.4.5.4). SHINE is responsible for providing rsight of the vendor, verifying deliverables are developed in accordance with approved quality procurement documents, and maintaining the vendor as an approved supplier on the SHINE roved supplier list (Subsection 7.4.5.4.1).
2.2.3        General Instrumentation and Control Requirements TRPS Criterion 14 - The TRPS safety function shall perform and remain functional during normal operation and during and following a design basis event.
TRPS equipment is installed in the seismically qualified portion of the main production facility re it is protected from earthquakes, tornadoes, and floods. The TRPS equipment is Seismic egory I, designed in accordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013) bsection 7.4.3.6). The TRPS control and logic equipment is located in a mild operating ironment inside RPF, irradiation facility (IF), and the facility control room, protected from NE Medical Technologies                    7.4-9                                          Rev. 4
 
pective environments (Subsection 7.4.3.5). The TRPS is qualified for a mild operating ironment by applying the guidance of Sections 4.1, 5.1, 6.1, and 7 of IEEE ndard 323-2003 (IEEE, 2003b).
TRPS Criterion 15 - Manual controls of TRPS actuation components shall be implemented downstream of the digital I&C portions of the safety system.
TRPS logic diagrams (Figure 7.4-1) display where the manual actuation is brought into the
: c. Manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the TRPS architecture shown in ure 7.1-2 (Subsection 7.4.5.2.4).
2.2.4        Single Failure TRPS Criterion 16 - The TRPS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the TRPS, and such failure shall not prevent the TRPS and credited passive redundant control components from performing its intended functions or prevent safe shutdown of an IU cell.
TRPS consists of three divisions of input processing and trip determination and two divisions ctuation logic arranged such that no single failure within the TRPS results in the loss of the ective function. Redundancy is addressed in Subsection 7.4.5.2.2. Nonsafety-related inputs the TRPS are designed and controlled so they do not prevent the TRPS from performing its ty functions. Single failure is additionally addressed in Subsection 7.4.3.4.
modes of single system component failures and satisfaction of the single failure criterion e evaluated for the TRPS using an FMEA and single failure analysis. The FMEA determined there are no single failures or non-detectable failures that can prevent the TRPS from orming its required safety functions. The single failure analysis determined that for functions uiring either one-out-of-two voting or two-out-of-three voting, a single failure of a channel will prevent a protective action when required. Additional discussion of the FMEA and single re analysis is provided in Subsection 7.4.5.2.2.
TRPS Criterion 17 - The TRPS shall be designed such that no single failure can cause the failure of more than one redundant component.
TRPS is comprised of three divisions of signal condition and trip determination, and two sions of voting and actuation. This configuration allows for the architecture to handle a single re of a field input, signal conditioning circuit, or trip determination and still maintain the ability rovide needed number of valid inputs to the voting circuitry. A single failure of the voting logic he actuation logic is also acceptable within the configuration as the redundant division of ng logic and actuation logic is capable of performing the safety function. Functional pendence is addressed in Subsection 7.4.5.2.1 and redundancy is addressed in section 7.4.5.2.2. Single failure is additionally addressed in Subsection 7.4.3.4.
modes of single system component failures and satisfaction of the single failure criterion e evaluated for the TRPS using an FMEA and single failure analysis. The FMEA determined there are no single failures or non-detectable failures that can prevent the TRPS from NE Medical Technologies                      7.4-10                                          Rev. 4
 
prevent a protective action when required. Additional discussion of the FMEA and single re analysis is provided in Subsection 7.4.5.2.2.
2.2.5        Independence TRPS Criterion 18 - Interconnections among TRPS safety divisions shall not adversely affect the functions of the TRPS.
ety-related inputs to the TRPS which originate within a specific division of the TRPS are input and processed in, only the same division prior to being provided to any other division of the tem for voting purposes (Subsection 7.4.5.2.1).
TRPS Criterion 19 - A logical or software malfunction of any interfacing non-safety systems shall not affect the functions of the TRPS.
APL (which is constructed of discrete components and part of the EIM) is designed to vide priority to safety-related signals over nonsafety-related signals. Division A and Division B rity logic of the TRPS prioritizes the following TRPS inputs, with the first input listed having highest priority and each successive input in the list having a lower priority than the previous:
Automatic Safety Actuation, Manual Safety Actuation, and 2) PICS nonsafety control signals bsection 7.4.3.12). When the enable nonsafety control is not active, the nonsafety-related trol signals are ignored. If the enable nonsafety control is active, and no automatic safety ation or manual safety actuation command is present, the nonsafety control signal can trol the component (Subsection 7.4.3.3).
mode transition request input, which is a nonsafety-related input from the PICS, will not ersely affect the function of the TRPS. The mode transition request is described in section 7.4.4.2.
TRPS Criterion 20 - The TRPS shall be designed with physical, electrical, and communications independence of the TRPS both between the TRPS channels and between the TRPS and nonsafety-related systems to ensure that the safety functions required during and following any design basis event can be accomplished.
TRPS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related TRPS inputs and outputs are routed on-divisional cable raceways and are segregated from safety-related inputs and outputs bsection 7.4.3.9). Wiring for redundant divisions uses physical separation and isolation to vide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008). HIPS communication paths are designed such that a single re does not cause all safety functions of a division to be inoperable (Subsection 7.4.5.2).
TRPS Criterion 21 - Physical separation and electrical isolation shall be used to maintain the independence of TRPS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any design basis event can be accomplished.
NE Medical Technologies                      7.4-11                                        Rev. 4
 
is accident (Subsection 7.4.5.2.1) and nonsafety-related TRPS inputs and outputs are routed on-divisional cable raceways and are segregated from safety-related inputs and outputs bsection 7.4.3.9). Wiring for redundant divisions uses physical separation and isolation to vide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008).
TRPS Criterion 22 - The TRPS shall be designed such that no communication - within a single safety channel, between safety channels, and between safety and nonsafety systems - adversely affects the performance of required safety functions.
S communication paths are designed with simplicity such that a single failure does not cause afety functions of a division to be inoperable. The design uses triple redundant munication paths. A single failure does not cause all safety functions of that division to be erable (Subsection 7.4.5.2). Communication ports that are for communication outside of a S chassis implement the one-way communication with hardware (Subsection 7.4.5.3.2).
TRPS Criterion 23 - TRPS data communications protocols shall meet the performance requirements of all supported systems.
re are no data communications as safety inputs to the TRPS. Safety-related data munications are internal to the system only. The data communications to nonsafety-systems unidirectional. Data communications are discussed in Subsection 7.4.5.2.5.
TRPS Criterion 24 - The timing of TRPS data communications shall be deterministic.
TRPS implements deterministic data communications, as described in Subsection 7.4.5.2.5.
TRPS Criterion 25 - TRPS communications protocols shall conform to validated protocol specifications by formally generated test procedures and test data vectors and verify that the implementations themselves were constructed using a formal design process that ensures consistency between the product and the validated specification.
PS communication protocols are verified as conforming to the validated protocol cifications by the Project V&V Plan (Subsection 7.4.5.4.5).
TRPS Criterion 26 - The TRPS shall be designed such that no unexpected performance deficits exist in the communication protocol that could adversely affect the TRPS architecture.
communications independence, the TRPS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the TRPS which originate within a cific division of the TRPS are input to, and processed in, only the same division prior to being vided to any other division of the system for voting purposes (Subsection 7.4.5.2.1).
TRPS platform operates in a fully deterministic manner, as described in section 7.4.5.2.5, which allows implementation of a simple communication protocol using a NE Medical Technologies                    7.4-12                                          Rev. 4
 
hitecture.
2.2.6        Prioritization of Functions TRPS Criterion 27 - TRPS devices that receive signals from safety and nonsafety sources shall prioritize the signal from the safety system.
rity is provided to automatic and manual safety-related actuation signals over nonsafety-ted signals as described in Subsection 7.4.3.12.
2.2.7        Fail Safe TRPS Criterion 28 - The TRPS shall be designed to assume a safe state on loss of electrical power.
trolled components associated with safety actuations are designed to go to their safe state n deenergized (Subsection 7.4.3.8). TRPS outputs become deenergized on a loss of trical power to the TRPS.
2.2.8        Setpoints TRPS Criterion 29 - Setpoints for an actuation of the TRPS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications and facility design, and expected maintenance practices.
points in the TRPS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.4.3.11. Environmental allowances measurement computational errors are accounted for in the uncertainty analysis used to blish the setpoints. The setpoint analysis parameters in the documented analyses are sistent with the safety analysis, system design basis, technical specifications, facility design, expected maintenance practices.
TRPS Criterion 30 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.
points in the TRPS are based on a documented methodology that ensures adequate margin ts between setpoints and analytical limits or safety limits. The setpoint methodology is further cribed in Subsections 7.2.1 and 7.4.3.11. The established setpoints and associated ertainties ensure adequate margin to analytical limits or safety limits described in the nical specifications.
TRPS Criterion 31 - Where it is necessary to provide multiple setpoints for adequate protection based on particular modes of operation or sets of operating conditions, the TRPS NE Medical Technologies                      7.4-13                                        Rev. 4
 
tiple setpoints are used for the IU Safety Actuation based on neutron flux, dependent on the perating conditions (Subsections 7.4.4.1.1, 7.4.4.1.3, and 7.4.4.1.4). Each setpoint is cessed independently in the partial trip determination portions of the TRPS. Operational asses are applied based upon IU operating conditions in the final trip determination portion of TRPS, as described in Subsection 7.4.4.2, to ensure the more restrictive setpoint is used n required.
TRPS Criterion 32 - The sensitivity of each TRPS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.
points in the TRPS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.4.3.11. Setpoint analysis ameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and putational errors. The established setpoints and associated uncertainties ensure adequate gin to analytical limits or safety limits described in the technical specifications, which ensures the sensitivity of each sensor channel is commensurate with the knowledge of the variable.
2.2.9      Operational Bypass, Permissives, and Interlocks TRPS Criterion 33 - Permissive conditions for each TRPS operating or maintenance bypass capability shall be documented.
PS operating permissives are used to control the modes of operation of the IU cells. The de transition functions are described in Subsection 7.4.3.2. Operational use of the missives and conditions to be satisfied and operational bypasses is addressed in section 7.4.4.2. The TRPS receives input for the facility master operating permissive from the FAS. The TRPS functions associated with the facility master operating permissive are cribed in Subsection 7.4.3.2. A maintenance bypass function is available and is described in section 7.4.4.3. There are no permissive conditions associated with the maintenance bypass ability.
TRPS Criterion 34 - TRPS interlocks shall ensure that operator actions cannot defeat an automatic safety function during any operating condition where that safety function may be required, with the exception of the use of the maintenance bypass capability.
rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2, to ensure that operator actions cannot eat an automatic safety function during any operating condition where that safety function y be required. There are not automatic interlocks to prevent an operator from putting all rument channels in maintenance bypass (Subsection 7.4.4.3). Administrative controls are vided by the technical specifications to prevent placing the same SFM across more than one nnel in maintenance bypass.
NE Medical Technologies                      7.4-14                                        Rev. 4
 
PS implements logic associated with each mode of operation to prevent an operator from vating a bypass through changing the IU cell mode out of sequential order. Each mode of ration is achieved through manual input from the operator when permissive conditions for the t mode in the sequence have been met (Subsection 7.4.4.2).
TRPS Criterion 36 - Bypass capability shall not be provided for the mechanisms to manually initiate TRPS safety.
nual safety actuations are shown in the logic diagrams (Figure 7.4-1). There are no conditions allow manually initiated TRPS safety functions to be bypassed.
TRPS Criterion 37 - If provisions for maintenance or operating bypasses are provided, the TRPS design shall retain the capability to accomplish its safety function while a bypass is in effect.
design, certain variables as input to the safety actuations are bypassed in each operating de, as described in Subsection 7.4.4.2. The TRPS logic associated with each mode of ration prevents an operator from activating a bypass through changing the IU cell mode out equential order (Subsection 7.4.4.2), which allows the TRPS to retain the capability to omplish its required safety functions for the mode of operation. Use of the maintenance ass is performed in accordance with technical specification requirements bsection 7.4.4.3).
TRPS Criterion 38 - Whenever permissive conditions for bypassing a train or channel in the TRPS are not met, a feature in the TRPS shall physically prevent or facilitate administrative controls to prevent the unauthorized use of bypasses.
rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2. A maintenance bypass function is ilable, as described in Subsection 7.4.4.3. There are no permissive conditions associated the maintenance bypass capability.
TRPS Criterion 39 - All TRPS operating bypasses, either manually or automatically initiated, shall be automatically removed when the facility moves to an operating regime where the protective action would be required if an accident occurred.
rational bypasses are automatically initiated or removed dependent on the TRPS mode of ration, as described in Subsection 7.4.4.2, when the associated IU is moved from one mode peration to another, to ensure the automatic protective functions are available when required.
TRPS Criterion 40 - If operating conditions change so that an active operating bypass is no longer permissible, the TRPS shall automatically accomplish one of the following actions:
NE Medical Technologies                    7.4-15                                    Rev. 4
* Initiate the appropriate safety function(s).
rator action is required to transition the TRPS between normal operating modes as cribed in Subsection 7.4.3.2. Operational bypasses are initiated or removed dependent on TRPS mode of operation as described in Subsection 7.4.4.2. Interlocks are provided by the PS to prevent the operator from transitioning to the next operating mode unless certain ditions are met, as described in Subsection 7.4.3.2. If operating conditions change so that an ve operating bypass is no longer permissible to use, the TRPS removes the appropriate rating bypasses or initiates the appropriate safety function(s).
TRPS Criterion 41 - Portions of TRPS execute features with a degree of redundancy of one shall be designed so that when a portion is placed in maintenance bypass (i.e., reducing temporarily its degree of redundancy to zero), the remaining portions provide acceptable reliability.
re are no maintenance bypass capabilities associated with execute features for the TRPS.
maintenance bypass capabilities are associated with the sense and command features only.
ntenance bypass capabilities and their acceptability for use are further discussed in section 7.4.4.3.
TRPS Criterion 42 - Provisions shall exist to allow the operations staff to confirm that a bypassed TRPS safety function has been properly returned to service.
en a mode of operation changes, the bypasses from the previous mode are automatically oved as they are no longer appropriate. The status of each bypass is provided redundantly to operator through the monitoring and indication bus to the PICS, including any channel placed aintenance bypass (Subsection 7.4.4.3), which allows the operator to confirm that a function been bypassed or returned to service (Subsection 7.4.4.2). The PICS is described in tion 7.3 and operator displays and human factors considerations are addressed in tion 7.6.
2.2.10        Completion of Protective Actions TRPS Criterion 43 - The TRPS design shall ensure that once initiated, the safety actions will continue until the protective function is completed.
ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS. Completion of ective actions is described in Subsection 7.4.3.3.
TRPS Criterion 44 - Only deliberate operator action shall be permitted to reset the TRPS or its components following manual or automatic actuation.
y deliberate operator action can be taken to reset the TRPS following a protective action.
ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS. Completion of ective actions is described in Subsection 7.4.3.3.
NE Medical Technologies                      7.4-16                                      Rev. 4
 
enable nonsafety switch (when enabled) allows a facility operator to control the output state of TRPS with a hardwired binary control signal from the nonsafety-related controls. If the enable safety switch is active, and no automatic safety actuation or manual safety actuation signals present, the operator is capable of energizing or deenergizing any EIM outputs using the safety-related hardwired control signals (Subsection 7.4.3.3). Additionally, safety-related als are prioritized over nonsafety-related signals (Subsection 7.4.3.12).
2.2.11      Equipment Qualification TRPS Criterion 46 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges (such as high-energy faults and lightning) on the TRPS, including FPGA-based digital portions, shall be adequately addressed.
PS rack mounted equipment is installed in a mild operating environment and is designed to et the environmental conditions described in Subsection 7.4.3.5. Rack mounted TRPS ipment is tested to appropriate standards to show that the effects of EMI/RFI and power ges are adequately addressed. This testing includes emissions testing, susceptibility testing, surge withstand testing. Appropriate grounding of the TRPS is performed in accordance with tion 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).
2.2.12      Surveillance TRPS Criterion 47 - Equipment in the TRPS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the TRPS shall retain the capability to accomplish its safety function while under test.
TRPS design supports testing, maintenance, and calibration, as described in sections 7.4.4.3 and 7.4.4.4. Surveillance testing performed using the maintenance bypass ability during operation is controlled in accordance with the technical specifications to ensure the TRPS is capable of performing its safety functions when required (Subsection 7.4.4.3).
-testing features provide for monitoring as described in Subsection 7.4.4.4 to provide cation to the operator if conditions exist that could challenge operability of the equipment.
TRPS Criterion 48 - Testing, calibration, and inspections of the TRPS shall be sufficient to show that, once performed, they confirm that surveillance test and self-test features address failure detection, self-test features, and actions taken upon failure detection.
TRPS design supports testing, maintenance, and calibration, as described in sections 7.4.4.3 and 7.4.4.4. End-to-end testing of the entire TRPS platform can be ormed through overlap testing. All TRPS components have self-testing capabilities, except discrete APL of EIM which is functionally tested. The TRPS continuously provides redundant cation of self-testing results to the PICS to indicate to operators that the TRPS is operating ectly following testing, calibration, or inspections.
TRPS Criterion 49 - The design of the TRPS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.
NE Medical Technologies                      7.4-17                                        Rev. 4
 
bsection 7.4.4.5). The capabilities for testing in the design of the TRPS support the testing rvals in the technical specifications.
2.2.13      Classification and Identification TRPS Criterion 50 - TRPS equipment shall be distinctly identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.
h TRPS cable and component is uniquely identified in accordance with the SHINE ponent numbering guidelines. By identifying the specific component associated with the PS, the safety classification can be determined. The unique identification number indicates applicable system and division (Subsection 7.4.3.10).
2.2.14      Human Factors TRPS Criterion 51 - Human factors shall be considered at the initial stages and throughout the TRPS design process to ensure that the functions allocated in whole or in part to the operator(s) can be successfully accomplished to meet TRPS design goals.
man factors is a design consideration for development of the TRPS. Changes to the design ughout the lifecycle process include human factors considerations (Subsection 7.4.5.4.2).
man factors design is described in Subsection 7.4.3.7.
TRPS Criterion 52 - The TRPS shall include readily available means for manual initiation of each protective function at the system level.
TRPS provides manual safety actuation capability as shown in the logic diagrams.
ure 7.4-1 displays where the manual actuation is bought into the logic. Human factors design upport of manual initiation is described in Subsection 7.4.3.7.
TRPS Criterion 53 - The TRPS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator and requiring manual operator reset when all conditions to resume operation are met and satisfied.
TRPS associated with each IU includes redundantly isolated outputs for each safety-related rument channel to provide monitoring and indication information to the PICS bsection 7.4.3.7), which includes indication of TRPS actuation device status. This supports unciation of the channel initiating a protective action. The TRPS requires manual operator et when conditions to resume operation are met and satisfied as described in TRPS erion 44 (Subsection 7.4.2.2.10).
2.2.15      Quality TRPS Criterion 54 - The quality of the components and modules in the TRPS shall be commensurate with the importance of the safety function to be performed.
safety-related TRPS is designed, fabricated, erected, and tested by SHINEs safety-related trol system vendor in accordance with the vendors Project Quality Assurance Plan NE Medical Technologies                    7.4-18                                      Rev. 4
 
TRPS Criterion 55 - Controls over the design, fabrication, installation, and modification of the TRPS shall conform to the guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010).
TRPS design, fabrication, installation, and modification is performed in accordance with a lity assurance program which conforms to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS,
: 5) as endorsed by Regulatory Guide 2.5 (USNRC, 2010) (Subsection 7.4.3.13).
3        DESIGN BASIS TRPS monitors variables important to the safety functions of the irradiation process during h operating mode of the IU and performs one or more of the following safety actuations upon ching specified analytical values:
* IU Cell Safety Actuation
* IU Cell Nitrogen Purge
* IU Cell TPS Actuation
* Driver Dropout TRPS also contains pre-established interlocks and permissives to control transition between perating modes to ensure safe operation of the main production facility.
section 7.4.4 addresses the specific variables that provide input into the TRPS, the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time.
technical specifications and bases describe the limiting safety system settings associated the TRPS monitored variables and margins to the analytical limits.
3.1          Safety Functions TRPS consists of eight subsystems, one for each of the eight IUs. The safety functions cribed in this subsection are applicable to each TRPS subsystem independently.
3.1.1        IU Cell Safety Actuation IU Cell Safety Actuation is initiated in response to process variables indicating abnormal ditions. An IU Cell Safety Actuation shuts down the irradiation process and isolates the ary system boundary and primary confinement boundary.
IU Cell Safety Actuation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.2, Scenarios 1, 2, 3, 4, 5, 6, 10, and 11), reduction in cooling events bsection 13a2.1.3, Scenarios 1 and 2), mishandling or malfunction of target solution events bsection 13a2.1.4, Scenario 4), external events (Subsection 13a2.1.6, Scenarios 2 and 5),
NE Medical Technologies                    7.4-19                                      Rev. 4
 
bsection 13a2.1.11, Scenarios 1 and 2), and facility specific - neutron driver assembly tem (NDAS) events (Subsection 13a2.1.12, Scenario 3).
U Cell Safety Actuation causes a transition of the TRPS to Mode 3 operation, isolation of the ary system boundary, and isolation of the primary confinement boundary via transition of h of the following components to their deenergized state.
Mode 3 Transition Components
* TSV dump valves
* NDAS high voltage power supply (HVPS) breakers Primary System Boundary Components
* TSV fill isolation valves
* TSV dump tank drain isolation valve
* TOGS gas supply isolation valves
* TOGS vacuum tank isolation valves
* Vacuum transfer system (VTS) lower lift tank target solution valves*
Primary Confinement Boundary Components
* PCLS supply isolation valve
* PCLS return isolation valves
* RVZ1e subsystem IU cell isolation valves
* Radiological ventilation zone 1 recirculation (RVZ1r) subsystem radioisotope process facility cooling system (RPCS) supply isolation valve
* RVZ1r RPCS return isolation valve
* TPS target chamber supply isolation valves
* TPS deuterium supply isolation valves
* TPS target chamber exhaust isolation valves
* TPS neutron driver evacuation isolation valves
* NDAS target/ion source cooling supply isolation valve
* NDAS target/ion source cooling return isolation valve
* NDAS vacuum pump cooling supply isolation valve
* NDAS vacuum pump cooling return isolation valve Cells 1 and 8 only have a single valve to the extraction lower lift tanks. The VTS lower lift target solution valves are redundant to the TSV dump tank drain isolation valve for an Cell Safety Actuation.
TRPS initiates an IU Cell Safety Actuation based on the following variables:
* High source range neutron flux
* High time-averaged neutron flux*
* High wide range neutron flux
* High RVZ1e IU cell radiation
* Low TOGS oxygen concentration
* Low TOGS mainstream flow (Train A)
* Low TOGS mainstream flow (Train B)
* Low TOGS dump tank flow NE Medical Technologies                    7.4-20                                        Rev. 4
* Low PCLS flow (180 second delay)
* High PCLS temperature (180 second delay)
* Low PCLS temperature
* Low-high TSV dump tank level
* High-high TSV dump tank level
* TSV fill isolation valve position indication not closed
* IU Cell Nitrogen Purge
* Facility master operating permissive gh time averaged neutron flux is calculated from power range neutron flux over a 45 second ng average.
section 7.4.4 provides additional details for each condition that results in an IU Cell Safety uation.
3.1.2        IU Cell Nitrogen Purge IU Cell Nitrogen Purge is initiated when monitored variables indicate a loss of hydrogen ombination capability in the IU. An IU Cell Nitrogen Purge results in purging the primary tem boundary for the affected IU with nitrogen.
IU Cell Nitrogen Purge is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.2, Scenario 5), and detonation and deflagration in the primary system ndary (Subsection 13a2.1.9, Scenario 1).
IU Cell Nitrogen Purge consists of an automatically or manually initiated transition of each of following components associated with the affected IU to their deenergized state and provides gnal to the ESFAS to initiate an ESFAS IU Cell Nitrogen Purge to deenergize the common ogen purge system (N2PS) IU cell header valves (see Subsection 7.5.3.1.22).
* Subcritical assembly system (SCAS) nitrogen purge isolation valves
* TOGS nitrogen vent isolation valves
* TOGS RPCS supply isolation valves
* TOGS RPCS return isolation valve TRPS initiates an IU Cell Nitrogen Purge based on the following variables:
* Low-high TSV dump tank level
* High-high TSV dump tank level
* Low TOGS oxygen concentration
* Low TOGS mainstream flow (Train A)
* Low TOGS mainstream flow (Train B)
* Low TOGS dump tank flow
* High TOGS condenser demister outlet temperature (Train A)
* High TOGS condenser demister outlet temperature (Train B)
* ESFAS loss of external power NE Medical Technologies                      7.4-21                                      Rev. 4
 
IU Cell TPS Actuation is initiated when monitored variables indicate a release of tritium in a glovebox. An IU Cell TPS Actuation results in isolating the TPS lines into and out of the ell, isolating the RVZ1 exhaust out of the IU cell, and deenergizing the neutron driver.
IU Cell TPS Actuation consists of an automatically or manually initiated transition of each of following components to their deenergized state and initiating a Driver Dropout (see section 7.4.3.1.4):
* TPS target chamber supply isolation valves
* TPS deuterium supply isolation valves
* TPS target chamber exhaust isolation valves
* TPS neutron driver evacuation isolation valves
* RVZ1e IU cell isolation valves TRPS initiates an IU Cell TPS Actuation based on the following variables:
* ESFAS IU Cell TPS Actuation
* ESFAS TPS Process Vent Actuation
* Facility master operating permissive 3.1.4        Driver Dropout river Dropout responds to monitored variables that indicate a loss of neutron driver output or ss of cooling to allow the SCAS to recover from NDAS or PCLS transients. A Driver Dropout tions differently depending on whether it was initiated based on loss of neutron driver output oss of cooling.
river Dropout is relied upon as a safety-related control for insertion of excess reactivity events bsection 13a2.1.2, Scenario 4), and reduction in cooling events (Subsection 13a2.1.3, narios 1 and 2). The TRPS initiates a Driver Dropout based on:
* Low power range neutron flux
* Low PCLS flow
* High PCLS temperature
* IU Cell TPS Actuation
* Facility master operating permissive TRPS initiates a loss of neutron driver Driver Dropout on low power range neutron flux by ning the NDAS HVPS breakers with a timed delay. Driver Dropout on low power range tron flux is bypassed until the power range neutron flux has reached the power range driver pout permissive. After the bypass of Driver Dropout on low power range neutron flux has n removed, it remains removed until a mode transition or both HVPS breakers are open. The PS implements a timed delay of [                  ]PROP/ECI from the time the low power range tron flux signal is initiated, indicating that the neutron flux has exceeded its lower limits, to n the TRPS output to the HVPS breakers is deenergized. If fewer than two-out-of-three low er range neutron flux actuation signals are present before the timer has expired, then the low er range neutron flux timer resets. This delay allows the neutron driver to be restarted or to art automatically within analyzed conditions.
NE Medical Technologies                        7.4-22                                        Rev. 4
 
ts down the neutron driver to prevent overheating of the target solution, while allowing the et solution to remain within the TSV. The breakers are then interlocked open until the PCLS and temperature are in the allowable range. If PCLS flow and temperature are not in the wable range within 180 seconds, an IU Cell Safety Actuation is initiated, as described in section 7.4.3.1.1.
3.2          Mode Transition design of the TRPS includes use of permissives and interlocks to control transition between perating modes to ensure safe operation of the main production facility. IU operating modes described in Subsection 7.3.1.1.
h mode transition in the TRPS is initiated manually through the PICS; however, transition to de 3 can occur automatically by an IU Cell Safety Actuation or by use of the control key to ctivate the facility master operating permissive. Before an operator is able to manually sition to a different mode, the transition criteria conditions must be met. Figure 7.4-1 shows a e diagram of the mode transitions.
de 0 to Mode 1 Transition Criteria TRPS permissives prevent transitioning from Mode 0 to Mode 1 until the TSV dump valves TSV fill isolation valves have been confirmed to be closed and TOGS mainstream flow is at bove the low flow limit. Normal control of actuation component positions when going from de 0 to Mode 1 is manual and independent from TRPS mode transition.
de 0 to Mode 3 Transition Criteria nsition from Mode 0 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive (Subsection 7.4.4.2). Initiation of transition generates an IU Cell Safety Actuation.
de 1 to Mode 2 Transition Criteria TRPS permissives prevent transitioning from Mode 1 to Mode 2 until the TSV fill isolation es indicate fully closed. Normal control of actuation component positions when going from de 1 to Mode 2 is manual and independent from TRPS mode transition.
de 1 to Mode 3 Transition Criteria nsition from Mode 1 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive (Subsection 7.4.4.2). Initiation of transition generates IU Cell Safety Actuation.
de 2 to Mode 3 Transition Criteria TRPS permissives prevent transitioning from Mode 2 to Mode 3 until the NDAS HVPS akers have been confirmed opened. Normal control of the HVPS breakers from closed to n is manual and independent from TRPS mode transition. Normal transition of the dump NE Medical Technologies                      7.4-23                                        Rev. 4
 
nsition from Mode 2 to Mode 3 may also be initiated automatically by TRPS or manually by an rator via manual actuation or the facility master operating permissive (Subsection 7.4.4.2).
ation of this transition generates an IU Cell Safety Actuation.
de 3 to Mode 4 Transition Criteria nsition of the TRPS from Mode 3 to Mode 4 is prevented if an automated IU Cell Safety uation is present. Normal control of actuation components is manual and independent from PS mode transition.
de 3 to Secure State Transition Criteria nsition from Mode 3 to the secure state is initiated manually by an operator via disengaging facility master operating permissive (Subsection 7.4.4.2). While operating in the secure state, sition to another mode of operation is not allowed.
de 4 to Mode 0 Transition Criteria TRPS permissives prevent the transition from Mode 4 to Mode 0 until the TSV dump tank l is below the low-high dump tank level setpoint. There is no requirement for normal control of actuation components to transition from Mode 4 to Mode 0.
de 4 to Mode 3 Transition Criteria nsition from Mode 4 to Mode 3 is initiated automatically by TRPS or manually by an operator manual actuation or the facility master operating permissive (Subsection 7.4.4.2). Initiation of transition generates an IU Cell Safety Actuation.
ure State to Mode 3 Transition Criteria nsition from the secure state to Mode 3 is initiated manually by an operator via engaging the lity master operating permissive (Subsection 7.5.4.3). Initiation of this transition permits a sition to another mode of operation.
3.3          Completion of Protective Actions TRPS is designed so that once initiated, protective actions will continue to completion. Only berate operator action can be taken to reset the TRPS following a protective action.
ure 7.4-1 shows how the TRPS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the TRPS to normal rating conditions.
output of the TRPS is designed so that actuation through automatic or manual means of a ty function can only deenergize the output. If there is no signal present from the automatic ty actuation or manual safety actuation, then the output of the EIM remains in its current
: e. An enable nonsafety switch allows a facility operator, after the switch has been brought to NE Medical Technologies                      7.4-24                                      Rev. 4
 
ted control signals from adversely affecting safety-related components. If the enable safety switch is active, and no automatic safety actuation or manual safety actuation signals present, the operator is capable of energizing or deenergizing any EIM outputs using the safety-related hardwired control signals. If the enable nonsafety switch is not active, the safety-related hardwired control signals are ignored.
3.4            Single Failure TRPS consists of three divisions of input processing and trip determination and two divisions ctuation logic (see Figure 7.1-2), arranged such that no single failure within the TRPS results e loss of the protective function, and no single failure in a single measurement channel can erate an unnecessary safety actuation.
safety-related inputs into the TRPS are designed and controlled so they do not prevent the PS from performing its safety functions. The only nonsafety inputs into the TRPS are those the PICS for control, the discrete mode input, and monitoring and indication only variables.
nonsafety control signals from the PICS are implemented through a hardwired parallel rface that requires the PICS to send a binary address associated to the output state of the along with a mirrored complement address. The mirrored complement address prevents any le incorrectly presented bit from addressing the wrong EIM output state. To prevent the PICS inadvertently presenting a valid address, the TRPS contains an enable nonsafety switch controls when the hardwired parallel interface within the APL is active, thus controlling when PICS inputs are allowed to pass through the input circuitry and for use in the priority logic in the APL. When the enable nonsafety switch is not active, the nonsafety-related control al is ignored. If the enable nonsafety is active, and no automatic or manual safety actuation mand is present, the nonsafety-related control signal can control the TRPS output. The M provides isolation for the nonsafety-related signal path.
discrete mode input has a unique input for each of Division A and Division B. The HWM vides isolation of the signal path into the TRPS. As a discrete input, the three failure modes are addressed are stuck high, stuck low, or oscillating. Because the TRPS only clocks in a mode on the rising edge of the mode input, an input stuck low or high would maintain the PS in the same mode and continue monitoring the variables important to the safe operation of mode. If the mode input began oscillating continuously between a logic high and low, the PS would only allow the mode to change if permissive conditions for the current mode are
. If the permissive conditions place the IU into a state that within the transitioned mode are ide of the predetermined operating limits, then the TRPS would initiate an IU Cell Safety uation and transition to and maintain Mode 3, ignoring any further input from the discrete de input.
following instances exist in the design where TRPS only actuates a Division A component a passive check valve is credited as a redundant component:
* A TOGS RPCS return check valve is provided in series with the TOGS RPCS return isolation valve to support isolation during an IU Cell Nitrogen Purge.
* A PCLS supply check valve is provided in series with the PCLS supply isolation valve to support isolation during an IU Cell Safety Actuation.
NE Medical Technologies                      7.4-25                                      Rev. 4
 
TRPS provides separate communication paths to the PICS display systems from each of the e TRPS divisions.
PS division A is powered from division A of the uninterruptible electrical power supply system SS). TRPS division B is powered from division B of the UPSS. TRPS division C receives tioneered power from division A and division B of the UPSS. The UPSS provides ty-related 125-volt direct current (VDC) and 208Y/120-volt alternating current (VAC) power ystem loads, including the TRPS, as described in Subsection 8a2.2.3.
h division of the TRPS contains three redundant 125 VDC to 24 VDC converters. The VDC power is distributed to each of three chassis mounting bays, where it is then used to er two redundant 24 VDC to 5 VDC converters located beneath each chassis bay. These vide independent +5-volt (V) A and +5V B power channels to each chassis. This configuration ws for the architecture to handle a single failure of a power supply.
3.5          Operating Conditions TRPS control and logic functions are located inside the RPF, IF, and facility control room, re the environment is mild and not exposed to the irradiation process, and is not subjected to rational cycling. However, cables providing signals to and from the TRPS are routed through radiologically controlled area (RCA) and into the IUs, where those cables are exposed to sher environments. Many of the sensors providing information to the TRPS are connected to primary system boundary, so the cable routing to these sensors is exposed to the operating ironment of the irradiation process.
ing normal operation, the TRPS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, replaced at a frequency sufficient such the radiation qualification of the affected components is not exceeded. The radiation lification of the affected components is based upon the total integrated dose (TID) identified able 7.2-1 being less than the threshold values identified in industry studies.
environmental conditions present anywhere a component within the boundary of the TRPS y reside are outlined in Table 7.2-2 through Table 7.2-6. The facility heating, ventilation, and conditioning (HVAC) systems are relied upon to maintain the temperature and humidity ameters in these areas. The facility HVAC systems are described in Section 9a2.1.
3.6          Seismic, Tornado, Flood TRPS equipment is installed in the seismically qualified portion of the main production facility re it is protected from earthquakes, tornadoes, and floods. The TRPS equipment is Seismic egory I, tested using biaxial excitation testing and triaxial excitation testing, in accordance Section 8 of IEEE Standard 344-2013 (IEEE, 2013).
3.7          Human Factors TRPS provides the following manual actuation capabilities via individual manual push ons for each TRPS subsystem:
NE Medical Technologies                      7.4-26                                        Rev. 4
* Driver Dropout h TRPS Divisions A and B respond to the activation of a push button. A manual IU Cell TPS uation on all eight TRPS subsystems is initiated via the manual TPS Isolation push button ted on the ESFAS main control board panel (see Subsection 7.5.3.6).
support the use of manual safety actuations, the TRPS subsystem associated with each IU includes isolated outputs for each safety-related instrument channel to provide monitoring indication information to the PICS. To facilitate operator indication of mode control status, PS actuation function status, manual initiation, and reset of protective actions, the TRPS, at division level, includes isolated input/output for the following:
* Indication of TRPS variable values
* Indication of TRPS parameter values
* Indication of TRPS logic status
* Indication of TRPS equipment status
* Indication of TRPS actuation device status
* Indication of TRPS mode rator display criteria and design are addressed in Section 7.6.
3.8          Loss of External Power TRPS is powered from the UPSS, which provides a reliable source of power to maintain the PS functional during normal operation and during and following a design basis event. The SS is designed to provide power to the TRPS for two hours after a loss of off-site power. The SS is described in Section 8a2.2.
trolled components associated with safety actuations are designed to go to their safe state n deenergized. On a loss of power to the TRPS, the TRPS deenergizes actuation ponents to the positions defined below:
Mode 3 Transition Components
* TSV dump valves - Open
* NDAS HVPS breakers - Open Primary System Boundary Components
* TSV fill isolation valves - Closed
* TSV dump tank drain isolation valve - Closed
* TOGS gas supply isolation valves - Closed
* TOGS vacuum tank isolation valves - Closed
* VTS lower lift tank target solution valves - Closed Primary Confinement Components
* PCLS supply isolation valve - Closed
* PCLS return isolation valves - Closed
* RVZ1e IU cell isolation valves - Closed
* RVZ1r RPCS supply isolation valve - Closed NE Medical Technologies                    7.4-27                                        Rev. 4
* TPS deuterium supply isolation valves - Closed
* TPS target chamber exhaust isolation valves - Closed
* TPS neutron driver evacuation isolation valves - Closed
* TOGS RPCS supply isolation valves - Closed
* TOGS RPCS return isolation valve - Closed
* NDAS target/ion source cooling supply isolation valve - Closed
* NDAS target/ion source cooling return isolation valve - Closed
* NDAS vacuum pump cooling supply isolation valve - Closed
* NDAS vacuum pump cooling return isolation valve - Closed Nitrogen Purge Components
* SCAS nitrogen purge isolation valves - Open
* TOGS nitrogen vent isolation valves - Open 3.9          Fire Protection TRPS design utilizes physical separation to minimize the effects from fire or explosion.
ety-related equipment for different divisions is located in separate fire areas when practical.
eptions include components for all three divisions located in the facility control room, in an vidual irradiation unit (IU) or in TOGS cells, and in other locations where end devices are alled.
sical separation is used to achieve separation of redundant sensors. Wiring for redundant sions uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each of Division A, Division B, Division C. Division A and C cables are routed along the south side of the RPF to go to the lity control room and Division B cables are routed on the north side of the RPF. Where sible, conduit is routed subgrade to provide additional separation. Instrument transmitters are ted in separate areas: A and C instrumentation is located primarily on the east side of the n production facility G-line wall, while Division B is along the west side of the wall.
sion A and C TRPS cabinets are separated by a minimum of four feet and are located on the osite side of the facility control room from where the Division B cabinets are located. Class A Class C fire extinguishers for fire suppression are utilized in the facility control room to nguish fires originating within a cabinet, console, or connecting cables. Wet sprinklers are not d in the facility control room to avoid potentially impairing the ability of the TRPS to perform its ty functions.
combustible and heat resistant materials are used whenever practical in the TRPS design, icularly in locations such as confinement boundaries and the facility control room. Use of erials that release toxic or corrosive gases under combustion is minimized.
safety-related TRPS inputs and outputs are routed in non-divisional cable raceways and are regated from safety-related inputs and outputs. Spatial separation between cable and eway groups is in accordance with Section 5.1.1.2, Table 1 of Section 5.1.3.3, and Table 2 of tion 5.1.4 of IEEE 384-2008 (IEEE, 2008).
NE Medical Technologies                      7.4-28                                          Rev. 4
 
h TRPS cable and component is uniquely identified in accordance with the SHINE ponent numbering guidelines. The equipment identification includes, but is not limited to, tem designation (code), equipment train, and division.
3.11        Setpoints servative setpoints for the TRPS monitored variables are established based in documented lysis methodology (Subsection 7.2.1). Setpoint analysis parameters typically consider rument precision, sensitivity, accuracy, loop uncertainties, and computational errors.
quate margin is required between the setpoints and the associated safety limits to ensure the ective action is initiated prior to the safety limit being exceeded. The setpoint values are ved from approved system design technical reports, design calculations, uncertainty ulations, and technical specifications.
log signals are input into the input sub-module (ISM) of an SFM. The ISM consists of a signal ditioning circuit, analog to digital converter, and a serial interface to the SFM FPGA. The ISM verts the process analog input signal to a raw value in digital format, which is provided to the M where it is compared with a setpoint in raw value.
3.12        Prioritization of Functions APL (which is constructed of discrete components and part of the EIM) is designed to vide priority to safety-related signals over nonsafety-related signals. Division A and Division B rity logic of the TRPS prioritizes the following TRPS inputs, with the first input listed having highest priority and each successive input in the list having a lower priority than the previous:
: 1) Automatic Safety Actuation, Manual Safety Actuation
: 2) PICS nonsafety control signals manual actuation signals input from the operators in the facility control room is brought ctly into the discrete APL The manual actuation input into the priority logic does not have the ity to be bypassed and will always have equal priority to the automated actuation signal over other signals that are present. Failures of the EIM do not defeat APL prioritization of the omatic or manual safety actuations over the PICS control signals.
3.13        Design Codes and Standards following codes and standards are applied to the TRPS design:
: 1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet TRPS Criterion 14.
: 2) IEEE Standard 379-2000, IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked as guidance to meet SHINE Design Criterion 15.
: 3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked as guidance for separation of NE Medical Technologies                      7.4-29                                        Rev. 4
: 4)    IEEE Standard 1012-2004, IEEE Standard for Software Verification and Validation (IEEE 2004a); invoked as guidance to meet TRPS Design Criterion 8.
: 5)    Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to meet TRPS Criterion 46 and to support electromagnetic compatibility qualification for digital I&C equipment.
: 6)    The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).
: 7)    IEEE Standard 323-2003, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations (IEEE, 2003b), invoked as guidance to meet TRPS Criterion 14.
4        OPERATION AND PERFORMANCE section 7.4.4 discusses the operation of the TRPS.
TRPS design basis functions utilize redundant logic to ensure safe and reliable operation to prevent a single failure from defeating the intended function. Additional information related he effects of single failure, reliability, redundancy, and independence can be found in section 7.4.2 and Subsection 7.4.5.
4.1            Monitored Variables and Response le 7.4-1 identifies specific variables that provide input into the TRPS and includes the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time. A discussion of each variable (signal input) and the system ponse is provided in this section.
4.1.1          High Source Range Neutron Flux high source range neutron flux signal protects against an insertion of excess reactivity during filling process (Subsection 13a2.1.2, Scenarios 5, 6, and 11). The signal is generated by PS when a source range neutron flux input exceeds the high level setpoint. The TRPS asses safety actuations based on the high source range neutron flux signal when filling vities cannot be in progress (i.e., Modes 2, 3, and 4), because the TSV fill isolation valves are ed. The signal is transmitted as an analog input to the TRPS from the neutron flux detection tem (NFDS) through three independent and redundant channels, one for each division of PS. When two-out-of-three or more high source range neutron flux signals are active, an Cell Safety Actuation is initiated.
4.1.2          Low Power Range Neutron Flux low power range neutron flux signal protects against loss of the neutron beam followed by a art of the neutron beam outside of analyzed conditions (Subsection 13a2.1.2, Scenario 4).
signal is generated by TRPS when a power range neutron flux input exceeds the low level NE Medical Technologies                      7.4-30                                      Rev. 4
 
ge neutron flux are bypassed until the power range neutron flux has reached the power range er dropout permissive. Once power range neutron flux levels have risen above the high oint, then the bypass on the low power range neutron flux is removed. The power range tron flux is measured as an analog input to the TRPS from the NFDS through three pendent and redundant channels, one for each division of TRPS. When two-out-of-three or e low power range neutron flux signals are active, a timer is started that must run to pletion for a Driver Dropout to be initiated. If, while the timer is running, less than two-out-of-e low power range neutron flux actuation signals are active, the timer is reset and the TRPS tinues operating under normal conditions.
4.1.3        High Time-Averaged Neutron Flux high time-averaged neutron flux signal protects against exceeding analyzed TSV power ls during Modes 1 and 2 (Subsection 13a2.1.2, Scenarios 1, 3, 5, and 10; section 13a2.1.6, Scenarios 2 and 5; and Subsection 13a2.1.8). The high time-averaged tron flux signal is generated by the TRPS, which averages the power range neutron flux input r a set time period, and compares the averaged power to the high level setpoint. The power ge neutron flux is measured as an analog input to the TRPS from the NFDS through three pendent and redundant channels, one for each division of TRPS. When two-out-of-three or e high time-averaged neutron flux signals are active, an IU Cell Safety Actuation is initiated.
4.1.4        High Wide Range Neutron Flux high wide power range neutron flux signal protects against exceeding solution power density ts during Modes 1 and 2 (Subsection 13a2.1.2, Scenario 4; and Subsection 13a2.1.8). The al is generated by TRPS when a wide range neutron flux input exceeds the high level oint. The wide range neutron flux is measured as an analog input to the TRPS from the DS through three independent and redundant channels, one for each division of TRPS. When
-out-of-three or more high wide range neutron flux actuation signals are active, an IU Cell ety Actuation is initiated.
4.1.5        High PCLS Temperature high PCLS temperature signal protects against a loss of cooling that could cause target tion heat-up (Subsection 13a2.1.2, Scenarios 2, 3, and 11; Subsection 13a2.1.3, narios 1 and 2; Subsection 13a2.1.6, Scenario 2; and Subsection 13a2.1.11, Scenario 2).
signal is generated by TRPS when a PCLS temperature input exceeds the high level oint. The PCLS temperature is measured on three different channels, one for each TRPS sion. Safety actuations based on high PCLS temperature are not bypassed when target tion is present in the TSV (Mode 1 and Mode 2) and are bypassed in all other modes. When
-out-of-three or more PCLS temperature inputs exceed the allowable limit, a timer is started must run to completion before initiating an IU Cell Safety Actuation. If, while the timer is ning, less than two-out-of-three high PCLS temperature signals are active, the timer is reset the TRPS continues operating under normal conditions. The timer is based on the eptability of a complete loss of cooling for up to three minutes prior to transferring target tion to the TSV dump tank.
NE Medical Technologies                      7.4-31                                          Rev. 4
 
low PCLS temperature signal protects against an overcooling of the target solution that ld cause an excess reactivity insertion (Subsection 13a2.1.2.2, Scenarios 2 and 3; and section 13a2.1.11.2, Scenario 2). The signal is generated by TRPS when a PCLS perature input exceeds the low level setpoint. The PCLS temperature is measured on three rent channels, one for each TRPS division. Safety actuations based on PCLS temperature not bypassed during filling and irradiation of the TSV (Mode 1 and Mode 2) and are bypassed ll other modes. When two-out-of-three or more PCLS temperature inputs drop below the wable limit, an IU Cell Safety Actuation is initiated.
4.1.7        Low PCLS Flow low PCLS flow signal protects against a loss of cooling that could cause target solution bulk ing (Subsection 13a2.1.3.2, Scenarios 1 and 2; Subsection 13a2.1.6.2, Scenario 2; and section 13a2.1.11.2, Scenario 1). The signal is generated by TRPS when a PCLS flow input eeds the low level setpoint. The PCLS flow is measured with an analog interface on three rent channels, one for each TRPS division. Safety actuation based on PCLS flow is not assed during filling and irradiation of the TSV (Mode 1 and Mode 2) and is bypassed in all er modes. When two-out-of-three or more PCLS flow inputs drop below the allowable limit, a r is started that must run to completion before initiating an IU Cell Safety Actuation. If, while timer is running, less than two-out-of-three low PCLS flow signals are active, the timer is et and the TRPS continues operating under normal conditions. The timer is based on the eptability of a complete loss of cooling for up to three minutes prior to transferring target tion to the TSV dump tank.
4.1.8        Low-High TSV Dump Tank Level low-high TSV dump tank level signal protects against a leak of liquid into the TSV dump
  , preventing the ability to transfer the entire batch of target solution from the TSV into the dump tank (Subsection 13a2.1.2.2, Scenario 5). The low-high TSV dump tank level signal results in a nitrogen purge of the IU for an anticipatory loss of TSV dump tank headspace r target solution has been transferred to the TSV dump tank (Subsection 13a2.1.9.2, nario 1). The low-high TSV dump tank level signal is received by the TRPS as a discrete t from level switches associated with three different channels, one for each TRPS division.
low-high TSV dump tank level switches are physically separate from the high-high level ches described in Subsection 7.4.4.1.9. Safety actuations based on the low-high TSV dump signal are bypassed during post irradiation when target solution is expected to be in the TSV p tank (Mode 3 and Mode 4). The low-high TSV dump tank signal is used as a permissive dition to transition operational modes from transferring of the target solution to the RPF de 4) to operating with no target solution in the IU (Mode 0). When two-out-of-three or more
-high TSV dump tank signals are active, an IU Cell Safety Actuation and an IU Cell Nitrogen ge are initiated.
4.1.9        High-High TSV Dump Tank Level high-high TSV dump tank level signal protects against an overfill of the TSV dump tank ater than the volume of target solution expected to be transferred from the TSV),
promising the ability of the TOGS to remove hydrogen from the TSV dump tank headspace bsection 13a2.1.9.2, Scenario 1). The high-high TSV dump tank level signal is received by NE Medical Technologies                      7.4-32                                        Rev. 4
 
l switches described in Subsection 7.4.4.1.8. When two-out-of-three or more high-high TSV p tank signals are active, an IU Cell Safety Actuation and an IU Cell Nitrogen Purge are ated.
4.1.10      Low TOGS Oxygen Concentration low TOGS oxygen concentration signal protects against a deflagration in the primary system ndary caused by the inability to recombine hydrogen with oxygen (Subsection 13a2.1.9.2, nario 1). The signal is generated by TRPS when a TOGS oxygen concentration input eeds the low level setpoint. The TOGS oxygen signal is measured with an analog interface hree different channels, one for each division of TRPS. When two-out-of-three or more TOGS gen concentration inputs drop below the allowable limit, an IU Cell Safety Actuation and an Cell Nitrogen Purge are initiated.
4.1.11      Low TOGS Mainstream Flow low TOGS mainstream flow signal protects against a deflagration in the primary system ndary caused by the inability to sweep accumulated hydrogen through the TOGS hydrogen ombiners (Subsection 13a2.1.9.2, Scenario 1; and Subsection 13a2.1.11.2, Scenario 1). The al is generated by TRPS when a TOGS mainstream flow input exceeds the low level oint. TOGS mainstream flow is measured independently for both TOGS Train A and TOGS n B. The TOGS mainstream flow is measured with an analog interface on three different nnels, one for each division of TRPS. Safety actuations based on the low TOGS mainstream are bypassed when no target solution is present in the IU. When two-out-of-three or more GS mainstream flow inputs drop below the allowable limit, an IU Cell Safety Actuation and an Cell Nitrogen Purge are initiated.
4.1.12      Low TOGS Dump Tank Flow low TOGS dump tank flow signal protects against a deflagration in the TSV dump tank sed by an inability to remove accumulated hydrogen from that tank (Subsection 13a2.1.9.2, nario 1; and Subsection 13a2.1.11.2, Scenario 1). The signal is generated by TRPS when a GS dump tank flow input exceeds the low level setpoint. TOGS dump tank flow is only asured for TOGS Train A, which is the only TOGS train that provides sweep gas flow to the dump tank. The TOGS dump tank flow is measured with an analog interface on three rent channels, one for each division of TRPS. Safety actuations based on the low TOGS p tank flow are bypassed when no target solution is present in the IU. When two-out-of-three ore TOGS dump tank flow inputs drop below the allowable limit, an IU Cell Safety Actuation an IU Cell Nitrogen Purge are initiated.
4.1.13      High TOGS Condenser Demister Outlet Temperature high TOGS condenser demister outlet temperature signal protects against adverse effects TOGS instrumentation and zeolite beds, causing them to fail to perform their safety functions bsection 13a2.1.9.2, Scenario 1). The signal is generated by TRPS when a TOGS condenser ister outlet temperature input exceeds the high level setpoint. TOGS condenser demister et temperature is measured independently for both TOGS Train A and TOGS Train B. The GS condenser demister outlet temperature signal is measured with a temperature interface NE Medical Technologies                    7.4-33                                      Rev. 4
 
uation and an IU Cell Nitrogen Purge are initiated.
4.1.14        ESFAS Loss of External Power ESFAS loss of external power signal is an anticipatory protection against the impending loss OGS blowers and recombiners after the runtime of that equipment on the UPSS has been eeded (Subsection 13a2.1.9.2, Scenario 1). The signal is generated by ESFAS and provided ach of the eight TRPS subsystems when ESFAS senses a loss of external (i.e., normal) er being provided to the UPSS as described in Subsection 7.5.4.1.19. TRPS does not eive the loss of external power signal from ESFAS until three minutes after the external power
  . The ESFAS loss of external power signal is measured with a discrete input signal on two rent channels, one for each Division A and Division B of TRPS. When an ESFAS loss of rnal power signal indicates power has been lost, the division receiving the discrete signal ates an IU Cell Nitrogen Purge.
4.1.15        High RVZ1e IU Cell Exhaust Radiation high RVZ1e IU cell exhaust radiation signal protects against a breach in the primary system ndary (Subsection 13a2.1.4.2, Scenario 4; and Subsection 13a2.1.9.2, Scenario 2). The high Z1e IU cell exhaust radiation is measured on the exhaust of the PCLS expansion tank located ach IU cell. The signal is generated by TRPS when an RVZ1e IU cell exhaust radiation input eeds the high level setpoint. The RVZ1e IU cell radiation is measured with an analog rface on three different channels, one for each division of TRPS. When two-out-of-three or e RVZ1e IU cell exhaust radiation channels exceed the allowable limit, an IU Cell Safety uation is initiated.
4.1.16        TSV Fill Isolation Valve Position Indication Not Closed SV fill isolation valve position indication not closed signal protects against the inadvertent ition of target solution to the TSV (Subsection 13a2.1.2.2, Scenario 6) via an inappropriately ned TSV fill isolation valve. The TSV fill isolation valve position indication is received by the PS as a discrete input from redundant position indicating limit switches on two different nnels for each valve. When one-out-of-two or more TSV fill isolation valve position indication als indicate the associated valve is not closed for either of the TSV fill isolation valves, an IU Safety Actuation is initiated. IU Cell Safety Actuation on TSV fill isolation valve position cation is only applicable when the IU cell is undergoing irradiation (Mode 2).
4.1.17        ESFAS IU Cell TPS Actuation ESFAS IU Cell TPS Actuation protects against release of tritium events in the TPS bsection 13a2.1.6.2, Scenario 3; and Subsection 13a2.1.12.2, Scenario 1). The actuation al is generated by ESFAS and provided to only the affected TRPS subsystems when the FAS initiates a TPS Train A/B/C Isolation as described in Subsections 7.5.3.1.18, 7.5.3.1.19, 7.5.3.1.20. The ESFAS IU Cell TPS Actuation is measured with a discrete input signal on different channels, one for each Division A and Division B of TRPS. When an ESFAS IU Cell Actuation signal indicates that an actuation is required, the division receiving the discrete al initiates an IU Cell TPS Actuation.
NE Medical Technologies                      7.4-34                                        Rev. 4
 
nonsafety-related Fill Stop function aids in controlling the rate of fill of the TSV, as described ubsection 13a2.1.2.2, Scenario 6. If Fill Stop parameters are not met, then the Fill Stop nergizes the TSV fill isolation valves blocking the fill path into the TSV.
ing Mode 1, after NFDS source range neutron flux has reached or exceeded 40 percent of maximum 95 percent fill flux, if the TSV fill isolation valve position indication signal indicates two in-series valves are not closed, then a [                ]PROP/ECI timer is initiated. If the TSV solation valve position indication signal indicates that both valves remain not closed at the of the [          ]PROP/ECI duration, then the TRPS initiates a Fill Stop. If the TSV fill isolation e position indication signal indicates that the valve(s) is (are) closed prior to the end of the [
OP/ECI duration, then the [              ]PROP/ECI timer resets.
ing Mode 1, after NFDS source range neutron flux has reached or exceeded 40 percent of maximum 95 percent fill flux, if the TSV fill isolation valve position indication signal indicates valve(s) is (are) closed, a 5-minute timer is initiated. If the TSV fill isolation valve position cation signal indicates both valves are not closed prior to the duration of the 5-minute timer ing, then the TRPS initiates a Fill Stop.
Fill Stop parameters ensure that target solution can only be added to the TSV for a ximum of [                ]PROP/ECI and that a 5-minute delay occurs between fill steps.
ill Stop is initiated when the facility master operating permissive key switch is disengaged, as cribed in Subsection 7.5.4.3.
4.2          Operational Bypass, Permissives, and Interlocks missive conditions, bypasses, and interlocks are created in each mode of operation specific hat mode to allow the operator to progress the TRPS to the next mode of operation. The PS implements logic associated with each mode of operation to prevent an operator from vating a bypass through changing the IU cell mode out of sequential order.
rational bypasses for the TRPS are based upon the mode of operation and are automatically lemented within the SBVMs to bypass safety actuations that are not required for each mode.
h mode of operation is achieved through manual input from the operator when permissive ditions for the next mode in the sequence have been met. A mode transition request occurs separate discrete inputs from PICS to each of the Division A and B HWMs, which then verts the mode transition input to a logic level signal and makes the signal available to the ociated SBVMs within the division. When associated permissives are satisfied and the nual operator action for mode transition occurs, the TRPS progresses to the next mode and SBVMs will: (1) automatically bypass the final trip determinations for safety actuations that not required for that particular mode of operation, and (2) will automatically remove any asses of the final trip determinations for safety actuations that are required for that particular de of operation. See the TRPS mode state diagram in the TRPS logic diagrams (Figure 7.4-1) he transitional sequence of the TRPS.
e permissive conditions are not met for transitioning to the next mode and the operator action urs, the TRPS will not advance to the next mode of operation. Below are the required NE Medical Technologies                        7.4-35                                            Rev. 4
* The TRPS shall only transition from Mode 0 to Mode 1 if all TSV dump valve position indications and all TSV fill isolation valve position indications indicate valves are fully closed and the TOGS mainstream flow is above the minimum flow rate.
* The TRPS shall only transition from Mode 1 to Mode 2 if the TSV fill isolation valve position indications indicate both valves are fully closed.
* The TRPS shall only transition from Mode 2 to Mode 3 if all HVPS breaker position indications indicate the breakers are open.
* The TRPS shall only transition from Mode 3 to Mode 4 if an IU Cell Safety Actuation is not present.
* The TRPS shall only transition from Mode 4 to Mode 0 if the TSV dump tank level is below the low-high TSV dump tank level.
ach mode of operation, the TRPS bypasses different actuation channels when the actuation nnel is not needed for initiation of an IU Cell Safety Actuation, an IU Cell Nitrogen Purge, an Cell TPS Actuation, or Driver Dropout. The lists below identify each variable that is bypassed ng the different modes of operation.
ety actuations based on the following instrumentation channels are bypassed in Mode 0:
* Low power range neutron flux
* Low PCLS temperature
* High PCLS temperature
* Low PCLS flow
* Low TOGS mainstream flow (Train A) (Train B)
* Low TOGS dump tank flow
* High TOGS condenser demister outlet temperature (Train A) (Train B)
* ESFAS loss of external power ety actuations based on the following instrumentation channels are bypassed in Mode 1:
* Low power range neutron flux
* TSV fill isolation valve position indication not closed
* Low PCLS flow
* High PCLS temperature ety actuations and interlocks based on the following instrumentation channels are bypassed ode 2:
* High source range neutron flux TRPS bypasses Driver Dropout on the low power range neutron flux signal until the power ge neutron flux is above the driver dropout permissive setpoint. The bypass is reapplied if e has been a change in mode of operation or if both HVPS breaker position indications cate in Mode 2 that they are open.
en the low power range neutron flux signal becomes active, a timer is started to create a
        ]PROP/ECI delay before a Driver Dropout is initiated. If fewer than two-out-of-three low NE Medical Technologies                      7.4-36                                        Rev. 4
 
PCLS flow and high PCLS temperature do not initiate an IU Cell Safety Actuation until after me delay of 180 seconds from the start of the low PCLS flow or high PCLS temperature al. If fewer than two-out-of-three low PCLS flow or high PCLS temperature signals are sent before the timer has expired, then the 180 second timer resets.
ety actuations and interlocks based on the following instrumentation channels are bypassed ode 3:
* High source range neutron flux
* Low power range neutron flux
* High PCLS temperature
* Low PCLS temperature
* Low PCLS flow
* Low-high TSV dump tank level
* TSV fill isolation valve position indication not closed TRPS includes the ability for the operator to transition the system from Mode 3 operation to cure state of operation. While in the secure state, an interlock is maintained preventing the PS from transitioning to the next sequential mode. The control key, via use of a facility master rating permissive, is used to place the TRPS into and out of the secure state. Should the tem be operating in a Mode other than Mode 3 when the facility master operating permissive switch (Subsection 7.5.4.3) is taken to Secure, the IU will transition to Mode 3 as described ubsection 7.4.3.2 and will be in the secure state.
ety actuations and interlocks based on the following instrumentation channels are bypassed ode 4:
* High source range neutron flux
* Low power range neutron flux
* High PCLS temperature
* Low PCLS temperature
* Low PCLS flow
* Low-high TSV dump tank level
* TSV fill isolation valve position indication not closed en a mode of operation changes, the bypasses from the previous mode are automatically oved as they are no longer appropriate. The status of each bypass is provided to the operator ugh the monitoring and indication bus to the PICS, including any channel placed in ntenance bypass (Subsection 7.4.4.3), which allows the operator to confirm that a function been bypassed or returned to service.
4.3          Maintenance Bypass h SFM can be placed in maintenance bypass or in a trip state by use of the OOS switch ted on the front of the SFM and an associated trip/bypass switch located below the SFM.
ails of the physical configuration and operation of the OOS and trip/bypass switches are vided in Sections 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). Any NE Medical Technologies                      7.4-37                                      Rev. 4
 
nitoring and indication bus to the PICS.
ndividual SFM within a TRPS division is allowed to be placed in maintenance bypass for up wo hours while the associated input channel(s) is required to be operable, in accordance with technical specifications, for the purpose of performing required technical specification veillance testing. A time limit of two hours is acceptable based on the small amount of time the nnel could be in bypass, the continual attendance by operations or maintenance personnel ng the test, the continued operability of the redundant channel(s), and the low likelihood that accident would occur during the two hour time period.
SFM may also be placed in trip by use of the OOS and trip/bypass switches, as described in tions 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). With the OOS ch in the OOS position, the trip/bypass switch is used to activate maintenance trips and ntenance bypasses. The trip/bypass switch signal is input first to an HWM, which then verts the trip/bypass discrete input to a logic level signal and makes the signal available to the ociated SBMs or SBVMs within the same division as the trip/bypass switch. When the OOS ch is in the Operate position and the SFM is functioning normally, the SBMs or SBVMs ociated with the SFM will ignore the associated trip/bypass switch input.
SFMs continually provide the status of their OOS switch to the associated divisional SBMs or VMs along with their partial trip information. With an SFMs OOS switch in the OOS position the associated trip/bypass switch in the trip position, the associated divisional SBMs or VMs will then assert all partial trip information associated with the SFM to the trip state for t to coincident logic voting in the SBVMs. All of the partial trip information associated with all ts for this SFM would be in a maintenance trip condition for this case. For those safety tions that use two-out-of-three coincident voting, a single failure of the same SFM in another sion would not defeat the safety function because the third remaining divisional SFM is ilable to complete a two-out-of-three vote if required. For those safety functions that only use
-out-of-two coincident voting, the safety functions would be actuated when the OOS switch is ed into the OOS position with the associated trip/bypass switch in the trip position.
h an SFMs OOS switch in the OOS position and the associated trip/bypass switch in the ass position, the associated divisional SBMs or SBVMs will then assert all partial trip rmation associated with the SFM to the bypassed state (not tripped) for input to coincident c voting in the SBVMs. All of the partial trip information associated with all inputs for this SFM ld be in a maintenance bypass condition for this case. For safety functions that use either
-out-of-two or two-out-of-three coincident voting, a single failure of the same SFM in another sion would defeat the safety function. Placing a single SFM in maintenance bypass is allowed he technical specifications for up to two hours for the purpose of performing required nical specification surveillance testing.
h an SFMs OOS switch in the OOS position and the associated trip/bypass switch in either trip or bypass position, the input channels associated with the SFM are inoperable.
4.4          Testing Capability ting of the TRPS consists of the inservice self-testing capabilities of the HIPS platform and odic surveillance testing.
NE Medical Technologies                      7.4-38                                        Rev. 4
 
ectly. Self-test features are provided for components that do not have setpoints or tunable ameters. All TRPS components, except the discrete APL of the EIM, have self-testing abilities that ensure the information passed on to the following step in the signal path is ect.
discrete logic of the APL of the EIM does not have self-test capability but is instead tionally tested. This functional testing consists of periodic simulated automatic and manual ations to verify the functionality of the APL and the manual actuation pushbuttons.
ting of input devices consists of channel checks, channel tests, and channel calibrations.
nnel checks are performed while the channel is in service. Channel tests and channel brations may be performed while the IU is in a mode where the channel is required to be rable (i.e., inservice) by placing the associated SFM in maintenance bypass bsection 7.4.4.3). Channel tests and channel calibrations for inputs provided to an SFM may be performed when the channel is not required to be operable. Channel tests of inputs vided to an HWM are performed when the channel is not required to be operable, since Ms are not provided with maintenance bypass capabilities.
4.5          Technical Specifications and Surveillance iting conditions for operation and surveillance requirements are established for TRPS logic, ng, and actuation divisions and instrumentation monitored by TRPS as input to safety ations. Limiting conditions for operation are established for components of the safety-related systems that perform safety functions to ensure that the system will remain available to orm safety functions when required. Surveillance requirements are performed at a frequency nsure that limiting safety system settings (Subsection 7.2.1) are not exceeded.
5        HIGHLY INTEGRATED PROTECTION SYSTEM DESIGN 5.1          HIPS Design Summary IPS platform is used to achieve the desired architecture for system control. The HIPS form is a generic digital safety-related instrumentation and control platform devoted to the lementation of safety-related applications in nuclear facilities. The platform is a logic-based form that does not utilize software or microprocessors for operation. It is composed of logic is implemented using discrete components and FPGA technology. The generic HIPS form is described in detail in Section 2.0 of Topical Report TR-1015-18653 (NuScale, 2017).
HIPS platform is utilized for the design of the TRPS and ESFAS. Modifications to the generic S platform made during the design of the TRPS and ESFAS were reviewed, evaluated, and umented.
HIPS platform Topical Report TR-1015-18653 included a representative architecture to trate how the HIPS platform meets the fundamental digital I&C principles of independence, undancy, predictability and repeatability, and diversity and defense-in-depth. The hitectures of the TRPS and ESFAS are described in Subsections 7.4.1 and 7.5.1, pectively. Approval of Topical Report TR-1015-18653 included identification of 65 Application cific Action Items (ASAIs). SHINE has evaluated the ASAIs and determined each has been sfactorily addressed for the HIPS implementation in the TRPS and ESFAS designs.
NE Medical Technologies                      7.4-39                                      Rev. 4
 
sistent with Appendix B of TR-1015-18653, the TRPS and ESFAS conforms to Section 5.5.1, tion 5.5.2, Section 5.5.3, and Section 5.6 of IEEE Standard 7-4.3.2-2003.
TRPS HIPS design is shown in Figure 7.1-2.
5.2            HIPS Design Attributes 5.2.1          Independence HIPS design incorporates the independence principles outlined in Section 4.0 of Topical ort TR-1015-18653 (NuScale, 2017).
built-in self-test (BIST) feature in the FPGA logic is separate and independent of the FPGA ty function logic; thus, the programming of the FPGA safety function logic is not made more plex by the inclusion of the diagnostic and self-test FPGA logic.
TRPS and ESFAS structures, systems, and components that comprise a division are sically separated to retain the capability of performing the required safety functions during a ign basis accident. Division independence is maintained throughout both systems, extending the sensor to the devices actuating the protective function. Physical separation is used to ieve separation of redundant sensors. Wiring for redundant divisions uses physical aration and isolation to provide independence for circuits. Separation of wiring is achieved g separate wireways and cable trays for each of Division A, Division B, and Division C.
sion A and C are located on the opposite side of the facility control room from where sion B is located.
communications independence, the TRPS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the TRPS which originate within a cific division of the TRPS are input to, and processed in, only the same division prior to being vided to any other division of the system for voting purposes.
vidual TRPS units are supplied for each of the eight irradiation units.
5.2.2          Redundancy HIPS design incorporates the redundancy principles outlined in Section 5 of Topical ort TR-1015-18653 (NuScale, 2017). The use of the redundancy design principles meets ions of the criteria for redundancy in SHINE Design Criterion 15.
SFM is designed with three redundant signal paths and begins the communication paths for o-out-of-three comparison. This internal redundancy provides for easy fault detection, giving er reliability from spurious actuation without increasing the complexity of the design.
undancy within the safety I&C system platform architecture is achieved by employing two or e divisions of sensors, detectors, and trip determination, and two divisions of trip and ation circuitry. Three divisions of sensors, detectors, and trip determination are selected for NE Medical Technologies                      7.4-40                                        Rev. 4
 
tiple divisions of sensors and detectors and trip and actuation determination is one of the chanisms employed to satisfy single-failure criteria and improve system availability.
ncidence voting on functions with three divisions of trip determination is implemented so that ngle failure of an input process signal will not prevent a trip or actuation from occurring when uired. In addition, a single failure of an input process signal with three divisions of trip ermination will not cause spurious actuation or inadvertent trips or actuations when they are required.
ure 7.1-2 shows typical signal data flow paths in the HIPS platform.
FMEA was conducted, analyzing failure modes of system components associated with the PS and ESFAS. The FMEA is a qualitative assessment which follows a systematic approach dentifying the modes of single system component failures and for evaluating their sequences.
ause of the triple redundant architecture within each redundant division of equipment for the PS and ESFAS, failure mechanisms that affect a single function have no effect on facility ration. As documented in the FMEA, failure modes that can prevent the systems from orming their intended functions are detected by design, built-in system diagnostics, or by odic testing. The results of the FMEA determined that there are no single failures or non-ectable failures that can prevent the TRPS or ESFAS from performing their required safety tions.
onjunction with the FMEA, a single failure analysis of the TRPS and ESFAS was conducted.
assessment applied to the sense and command and execute features of the TRPS and FAS used for safety-related functions. The scope of the assessment included sensors, trip ermination, signal conditioning, DC-DC converters and power supplies, and actuation logic.
single failure analysis determined that for functions requiring either one-out-of-two voting or
-out-of-three voting, a single failure of a channel will not prevent a protective action when uired.
5.2.3        Predictability and Repeatability HIPS design incorporates the predictability and repeatability principles outlined in Section 7 opical Report TR-1015-18653 (NuScale, 2017). The use of the predictability and repeatability ign principles meets portions of the criteria for ensuring an extremely high probability of omplishing safety functions as required by SHINE Design Criterion 19.
information in this section satisfies ASAI numbers 19, 56, and 59 from Topical ort TR-1015-18653 (NuScale, 2017).
h SBVM of the two actuation divisions receives inputs from the trip determination portions of SFMs through isolated receive-only serial data paths. The trip determinations are combined e voting logic so that two or more trip inputs from the trip determination modules produce an ation output demand signal, which is sent to dedicated APL circuits to actuate the ropriate equipment associated with that division. Manual trip and actuation capability also NE Medical Technologies                      7.4-41                                        Rev. 4
 
meet a response time performance requirement of 500 milliseconds, a HIPS platform-based tem must acquire the input signal that represents the start of a response time performance uirement, perform logic processing associated with the response time performance uirement, and generate an output signal that represents the end of a response time ormance requirement. These HIPS platform response time components exclude: (1) the ier plant process delays through the sensor input to the platform, and (2) the latter delays ugh a final actuating device to affect the plant process (Figure 7.4-2). The required response s credited in the safety analysis for systems using the HIPS design (TRPS, ESFAS) cover process delays through the sensor input to the platform and the delays through the final ating device.
5.2.4          Diversity APL portions within an EIM support the implementation of different actuation methods.
ing the capability for hardwired signals into each EIM supports the capability for additional diverse actuation means from automated actuation. As an example, a division of APL circuits y receive inputs automatically from the programmable logic portion of the TRPS, inputs from nual controls in the facility control room, and input signals from a nonsafety control system.
h the manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the TRPS architecture as shown in ure 7.1-2.
APL is implemented using discrete components and is not vulnerable to a software CCF.
HIPS design incorporates the diversity principles outlined in Section 6 of Topical ort TR1015-18653 (NuScale, 2017). The use of the diversity design principles meets ions of the criteria for diversity in SHINE Design Criterion 16.
information in this section satisfies the application-specific information requirements for AI numbers 62, 63, 64, and 65 from Topical Report TR-1015-18653 (NuScale, 2017).
rder to ensure performance in the presence of a digital CCF, the different divisions of the tem (TRPS, ESFAS) use different FPGA architectures (static random access memory, flash, ne-time programmable). A diversity and defense-in-depth (D3) assessment of the TRPS and FAS was performed using the guidance of NUREG/CR-6303 (USNRC, 1994) to identify ential vulnerabilities to digital CCFs. The D3 assessment concluded:
* Potential digital CCFs associated with the TRPS and ESFAS would not lead to a failure to initiate protective actions when required.
* Potential digital CCFs associated with the TRPS, ESFAS, and certain detectors could lead to spurious actuations without adverse impacts on safety.
* Potential digital CCFs associated with most detectors would not lead to a failure to initiate protective actions when required; however, in each instance where a potential digital CCF could cause a failure to initiate protective actions, there exists either an alternate automatic means of mitigating events or an alternate means for the operator to identify, initiate, and assess protective actions.
NE Medical Technologies                      7.4-42                                        Rev. 4
 
PS or ESFAS) and is transmitted to PICS for display on the static display screens of the main trol board or at the operator workstation. This monitoring and indication information provided ICS from TRPS and ESFAS includes the status and values of the monitored variables tified in Table 7.4-1 and Table 7.5-1 as well as the status of the TRPS and ESFAS systems mselves. Display of this monitoring and indication information in the facility control room vides the information operators require to determine if manual actuation of a safety system is ropriate. Variables monitored by the TRPS are provided to operators in the facility control m to change the IU operation mode and control the IUs. Variables monitored by the ESFAS provided to operators in the facility control room to monitor the operation and status of the IF RPF. Other information at the operator workstations or the main control board is aggregated instruments throughout the facility and displayed to the operator. Section 7.6 provides her detail on the SHINE display systems.
5.2.5          Simplicity plicity attributes have been considered and incorporated into the design of the I&C system hitecture. The I&C system architecture is consistent with proven safety system designs used nuclear production facilities.
HIPS technology utilized is based on only four core modules. The use of FPGA technology ws for modules to perform a broader range of unique functions yet utilize the same core ponents. Increased flexibility with core components provides simplified maintainability. The ntity of spare parts can be reduced to blank modules that are programmed and configured as ded.
ctions within the FPGA of each module are implemented with finite state machines in order to ieve deterministic behavior. The HIPS platform does not rely on complex system/platform trollers. Dedicating SFMs to a function or group of functions based on its inputs provides rent function segmentation creating simpler and separate SFMs that can be more easily ed. This segmentation also helps limit module failures to a subset of safety functions. The cation of inputs to SFMs is depicted in Figures 7.4-1 and 7.5-1.
physical layer of a communication module (CM) used for intradivisional communication is a tidrop topology; however, the flexibility afforded by FPGAs allows implementation of a simple al point-to-point communication protocol. Autonomous modules allow for simpler component ing, implementation, and integration.
of fundamentally different FPGA architectures provides a simple and verifiable approach to ipment and design diversity. In the D3 assessment (Subsection 7.4.5.2.4), functional diversity applied to the TRPS and ESFAS as monitoring different input process parameters on rent SFMs. By simply implementing safety functions on an SFM based on its inputs, safety tions have been segmented to provide functional diversity. The discrete and programmable c circuits on an EIM provide a clear distinction between those portions that are and are not erable to a software CCF. These diversity attributes simplify the system design by not having stall a separate diverse actuation system to address software CCF concerns.
lementation of triple redundant communication within a division of a HIPS platform increases number of components (e.g., additional CMs) but provides simpler maintenance and NE Medical Technologies                      7.4-43                                        Rev. 4
 
s not cause all safety functions of that division to be inoperable.
ctions within the FPGA of each module are implemented with finite state machines in order to ieve deterministic behavior. Deterministic behavior allows implementation of a simple munication protocol using a predefined message structure with fixed time intervals. This ple periodic communication scheme is used throughout the architecture. Communication ween SFMs and CMs is implemented through a simple and well-established RS-485 physical
: r. The configurable transmit-only or receive-only ports on a CM use a point-to-point physical
: r. Communication between modules is done asynchronously which simplifies implementation voiding complex syncing techniques.
5.3        Access Control and Cyber Security secure development operating environment, cyber security requirements, and access trol are discussed in this section.
5.3.1      Secure Development Operating Environment developmental process for creating safety-related applications (TRPS and ESFAS) has n delegated to SHINE's safety-related control system vendor. The process addresses the ential cyber security vulnerabilities (physical and electronic) in the developmental phases of software and the controls to prevent unauthorized physical and electronic access. The ure development controls are applied from developing the requirements of the software, igning the software, integrating the hardware and software, and testing the system. The elopment controls include physical access controls at the development facility, personnel ess controls that limit access to the system design information to authorized individuals, and use of an IDN.
HIPS platform contains design features that reduce the susceptibility to inadvertent access oth hardware and software and undesirable behavior from connected systems. These form features support the establishment and use of a secure operational environment and ective measures to maintain it.
cific requirements are defined to provide and maintain a secure operational environment ng the defined modes of operation. A requirements traceability matrix is used throughout the elopment process. Bi-directional traceability is independently verified to ensure that uirements are implemented (forward tracing) and that no unwanted or unnecessary code has n introduced (backward tracing).
5.3.2      Cyber Security Design Features efensive system architecture is utilized as shown in Figure 7.1-1.
defensive system architecture has the following characteristics:
* Communication outside of the system while in service is through one-way isolated communication ports over point-to point cables.
NE Medical Technologies                    7.4-44                                      Rev. 4
* Communication from a maintenance workstation (MWS) to a HIPS chassis is only allowed when the affected module is placed out of service by activating the OOS switch using a temporary cable that is attached from the MWS to a HIPS chassis.
* No capability for remote access to the safety system is included with the HIPS platform design.
5.3.3        Access Control itional access control features include:
* Required use of a physical key at the main control board to prevent unauthorized use.
* Rack mounted equipment is installed within cabinets that can be locked so access can be administratively controlled.
* FPGAs on any of the HIPS modules cannot be modified (for static random-access memory type) or replaced (for one-time programmable or flash types) while installed in the HIPS chassis.
* Capability to modify modules installed in the HIPS chassis is limited to setpoints and tunable parameters that may require periodic modification.
h division has a nonsafety-related MWS for the purpose of online monitoring and offline ntenance and calibration. The HIPS platform MWS supports online monitoring through
-way isolated communication ports. The MWS is used to update setpoints and tunable ameters in the HIPS chassis when the safety function is out of service. The MWS allows a nician password protected access to select the system (i.e., TRPS or ESFAS), the specific ell (for TRPS), the division (i.e., A, B, or C), the specific SFM, and the trip setpoint or input which is to be modified. Physical and logical controls are put in place to prevent difications to a safety channel when it is being relied upon to perform a safety function.
trols are also put in place to prevent inadvertent changes to a setpoint or tunable parameter.
mporary cable and OOS switch are required to be activated before any changes can be de to an SFM. When the safety function is removed from service, either in bypass or trip, an cation is provided by the HIPS platform that can be used to drive an alarm in the facility trol room to inform the operator. Setpoint and calibration data are stored on the nonvolatile mory (NVM). Adjustments to parameters are performed in accordance with technical cifications, including any that establish the minimum number of redundant safety channels must remain operable for the applicable operating mode and conditions.
5.4          Software Requirements Development ety-related systems are designed and implemented using a programmable logic-based I&C form that is based on fundamental safety-related I&C design principles of independence, undancy, predictability and repeatability, and diversity, and was developed specifically to vide a simple and reliable solution for safety-related applications. These design principles contribute to simplicity in both the functionality of the system and in its implementation.
systems are implemented on a logic-based platform that does not utilize traditional software icroprocessors for operation. It is composed of logic implemented using discrete ponents and FPGA technology. The platform design was developed to support meeting the NE Medical Technologies                      7.4-45                                        Rev. 4
 
HIPS platform has been reviewed and approved by the NRC for use in safety-related lications for commercial nuclear power plants (NuScale, 2017).
development of the systems has been delegated to SHINE's safety-related control system dor. Any modifications to the system logic required to be implemented after initial elopment activities are complete are also delegated to the vendor.
systems are developed using the vendor's PLDP, which describes a planned and systematic roach to design, implement, test, and deliver the safety-related programmable logic for the PS and ESFAS. The approach defines the technical and managerial processes necessary to elop high-quality products that satisfy the specified requirements.
systems are developed in accordance with the vendor's Project Quality Assurance Plan ch defines the techniques, procedures, and methodologies used to develop and implement systems.
vendors PLDP identifies the tasks and associated documentation for the process described ubsections 7.4.5.4.1 through 7.4.5.4.8. Results documented for the process, which onstrate compliance with SHINE vendor specifications, are submitted upon completion by vendor to SHINE for review and acceptance.
5.4.1      Key Responsibilities NE is responsible for providing oversight of the vendor, verifying deliverables are developed ccordance with approved quality and procurement documents, and maintaining the vendor as approved supplier on the SHINE approved supplier list.
vendor is responsible for developing and delivering the safety-related control systems in ordance with the processes identified in this section.
key responsibilities for the system development activities are identified in the vendor's ject Management Plan and project implementing procedures.
5.4.2        Programmable Logic Lifecycle Process programmable logic lifecycle process is shown in Figure 7.4-3 and provides an overview of programmable logic development process from planning through installation. The grammable logic lifecycle process is implemented through the vendor system design control cedure. The procedure defines the minimum system design control tasks from the planning se through the shipment phase.
ign interfaces are established during the design development process, and during the design ew and approval process. Design interfaces are controlled in accordance with the Project nagement Plan. The design interfaces include addressing any impacts on the safety system, trol console, or display instruments during the lifecycle process.
NE Medical Technologies                    7.4-46                                        Rev. 4
 
NE procurement and technical documents (e.g., specifications, drawings, input/output abase) are inputs to the planning phase. These documents are reviewed by the vendor to tify design input documents containing system requirements. The design input documents formally received from SHINE and controlled by version and date. Design output documents data required by SHINE are identified and scheduled for development.
yRS that defines the system design requirements detail is generated. The SyRS is generated ccordance with the vendor SyRS development procedure. A system design description is erated to define the system design details.
nning documents for the implementation of the programmable logic lifecycle process are eloped:
* Project PLDP
* Project Configuration Management Plan
* Project V&V Plan
* Project Equipment Qualification Plan
* Project Test Plan
* Project Security Plan
* Project Integration Plan nning phase documents are verified and processed in accordance with the vendor design ument and data control procedures.
5.4.2.2          Requirements Phase ardware requirements specification (HRS) is generated by the vendor to define the system dware requirements detail. The HRS is generated in accordance with the vendor HRS elopment procedure.
LRS is generated to translate the conformed design specification into project-specific grammable logic requirements. The PLRS is generated in accordance with the vendor PLRS elopment procedure.
PLRS is reviewed in accordance with the vendor verification process procedure.
grammable logic lifecycle activities from this point forward are performed within an SDE using DN. Exceptions for the use of an SDE and IDN may be specified by management in ordance with contract requirements and/or regulatory requirements, as defined in the vendor E and IDN Security Plan.
PLRS defines what the programmable logic should do, but not how the programmable logic ets the requirements. The complete description of the functions to be performed by the grammable logic is included in the PLRS.
en the programmable logic requirements are expressed by a requirement specification del, the model elements are categorized as either:
NE Medical Technologies                    7.4-47                                      Rev. 4
* Model elements that do not represent programmable logic requirements.
requirement specification model is developed to define the programmable logic functionality ccordance with the vendor model-based development procedure and reviewed in accordance the vendor verification process procedure.
5.4.2.3          Design Phase input documents to the design phase are the SyRS, HRS, and PLRS.
ardware design specification is generated to define the system hardware design details. The dware design specification is generated in accordance with the vendor hardware design cification development procedure.
LDS is generated to translate the PLRS into:
* A description of the functional requirements
* A description of the system or component architecture
* A description of the control logic, data structures, input/output formats, interface descriptions, and algorithms PLDS is generated in accordance with the vendor PLDS development procedure and ewed in accordance with the vendor verification process procedure.
he case when a PLDS is expressed by a design specification model, model elements that do represent programmable logic requirements or architecture and are not input to a subsequent elopment activity may be included in a model (for example, comment elements). These ments will not be implemented in the executable code and therefore need to be clearly tified. Model elements are categorized as described in the vendor model-based development cedure as either:
* Model elements that represent programmable logic design, including derived requirements or architecture, or
* Model elements that do not represent programmable logic design or architecture.
ign specification models are developed in accordance with the vendor model-based elopment procedure and are traceable, verifiable, and consistent.
ependent design review is performed to verify that the design meets the system requirements ccordance with the vendor verification process procedure. Design tests are performed to date that the design meets the system requirements in accordance with the vendor test trol procedure.
5.4.2.4          Implementation Phase input documents to the implementation phase are the completed tasks and approved uments from the development phase. Although implementation phase activities may proceed, NE Medical Technologies                      7.4-48                                      Rev. 4
 
HIPS platform hardware and programmable logic components are integrated into the project ng this phase to provide the target hardware and incorporate the HIPS platform grammable logic that has been previously designed, developed, tested, qualified, and lemented.
implementation phase ends at the completion of the programmable logic design, elopment, and verification. Exit to the test phase occurs when the completed programmable c is ready for validation on target hardware.
implementation phase V&V summary report documents the implementation phase exit. If trol point exit criteria are not met, a conditional release can be issued in accordance with the dor conditional release procedure prior to beginning test phase activities.
roved documents ready for V&V are placed into configuration management prior to lementation phase exit.
5.4.2.5          Test Phase test phase is the validation phase. Outputs from this phase, which are requirements of the ect but may not serve as inputs to the shipment phase, are completed prior to test phase exit.
ification that test phase tasks are complete and output documents are approved serves as control point to transition the project from the test phase to the shipment phase. The test se V&V summary report documents the test phase exit. Proceeding beyond the control point ore control point exit criteria are met adds risk to the successful completion of the project. If trol point exit criteria are not met, a conditional release may be issued in accordance with the dor conditional release procedure prior to the shipment phase.
roved documents are placed into configuration management prior to test phase exit.
5.4.2.6          Shipment Phase and Installation shipment phase prepares the system for shipment and ships the system to SHINE. Output uments from this phase are completed prior to shipment phase exit.
shipment phase V&V summary report is completed. The final V&V report documents the pleted project V&V activities.
pment phase documents are verified to be complete and approved prior to transitioning the ect from the shipment phase.
roved documents are placed into configuration management prior to shipment phase exit.
tems are installed and site acceptance tests are performed in accordance with written plans instructions prepared and controlled under the installer's quality assurance program. SHINE sponsible for providing oversight of the installer and maintaining the installer as an approved plier on the SHINE approved supplier list.
NE Medical Technologies                      7.4-49                                        Rev. 4
 
al release of a PLRS or PLDS does not require regression analysis. Subsequent releases of S or PLDS require regression analysis to determine the required independent V&V activities erform. Regression analysis is performed if changes are made to previously tested grammable logic to determine the impact to all parts of the system. This regression analysis urs prior to the execution of tests. Any tests based on the identified changes and impact lysis to detect any possible errors due to the recent changes are rerun. When the grammable logic requirements are expressed by a requirement specification model or grammable logic design is expressed by a design specification model, the regression analysis erformed in accordance with vendor model-based development procedure.
5.4.4        Project Requirements Traceability Matrix ystem requirements traceability matrix is developed by the vendor during each of the project ses. These traceability matrices are used for the traceability analysis tasks in each respective se. The system requirements traceability matrices are developed in accordance with the dor traceability matrix development procedure.
en using model-based development, identification of requirements in accordance with the hod defined in the vendor traceability matrix development procedure and vendor modeling dards document is used for bi-directional traceability between model elements and uirements external to the model.
5.4.5        Verification and Validation NE has delegated V&V activities related to the safety-related control system development to vendor. The vendor Project V&V Plan is designed to detect and report errors that may have n introduced during the system development process. The programmable logic verification cess verifies that:
* System requirements allocated to programmable logic have been developed into programmable logic requirements that satisfy those system requirements.
* Programmable logic requirements have been developed into logic architecture and design that satisfy the programmable logic requirements.
* Logic architecture and design have been developed into code that satisfies the logic architecture and design.
* Developed code satisfies the requirements and provides confidence that there is no unintended functionality.
* Developed code is robust such that it can respond properly to abnormal inputs and conditions.
* Methods used to perform this verification are technically correct and complete for the specified programmable logic integrity level.
E Standard 1012-2004 (IEEE, 2004a), Section 4, provides guidance on selection of criticality ls for software based on its intended use and application. The software and hardware eloped for the safety-related systems are classified as Software Integrity Level 2. The vendor ject V&V Plan for the system development was tailored and adapted for FPGA technology the guidance in IEEE Standard 1012-2004 (IEEE, 2004a). The V&V activities are NE Medical Technologies                    7.4-50                                        Rev. 4
 
V&V activities are performed using an internal V&V team from within the design anization. It is recommended, but not required, that the personnel performing the V&V vities are not the same personnel involved directly in the design. This organization structure selected taking into consideration the Software Integrity Level 2 classification of the project pe and the size of the vendor organization.
the lifecycle phases described in IEEE Standard 1012-2004 (IEEE, 2004a), the lifecycle ses applicable to the vendor work scope are the management and development phases. The V development phase activities follow the system development lifecycle as described in section 7.4.5.4.2.
V&V team is responsible for determining the extent to which a V&V task is repeated when its t or procedure is changed. Design changes are subject to design control measures mensurate with those applied to the original design per the vendor system design control cedure.
V personnel review each design output at the end of its lifecycle phase, prior to approving the verable. Revision control is performed in accordance with the Project Configuration nagement Plan.
a and document reviews are performed in accordance with the vendor verification process cedure and testing activities are performed in accordance with the vendor test control cedure.
system requirements traceability matrices are used to generate comprehensive validation procedure(s) that ensure that each requirement is adequately tested and meets the system uirements. Test procedure(s) are generated by V&V personnel.
5.4.5.1          Management Phase V&V V&V effort performs the following V&V tasks for management of V&V:
* Project V&V Plan Generation
* Baseline Change Assessment
* Management Review of V&V
* Management and Technical Review Support
* Interface with Organizational and Supporting Processes 5.4.5.2          Planning Phase V&V ification of the programmable logic planning process is conducted to ensure that the project s and procedures comply with the requirements and guidelines of the development dards and regulatory requirements, and that means are provided to execute the plans.
NE Medical Technologies                  7.4-51                                          Rev. 4
* Determine that the V&V methods enable the objectives of the development standards and regulatory guidelines.
* Verify that the development processes can be applied consistently.
* Verify that each development process produces evidence that its outputs can be traced to their activity and inputs, showing the degree of independence of the activity, the environment, and the methods used.
5.4.5.3          Requirements Phase V&V requirements phase reviews and analysis activities detect and report requirements errors may have been introduced during the requirements process. These reviews and analysis vities confirm that the programmable logic requirements satisfy the following objectives:
* Compliance with system requirements
* Accuracy and consistency
* Compatibility with the target hardware
* Testability
* Conformance to applicable standards and procedures
* Traceability 5.4.5.4          Design Phase V&V design phase review and analysis activities detect and report design errors that may have n introduced during the programmable logic design process. These reviews and analysis vities confirm that the programmable logic design satisfies the following objectives:
* Compliance with programmable logic requirements
* Accuracy and consistency
* Compatibility with the target hardware
* Testability
* Conformance to applicable standards and procedures
* Traceability ification of the design can be divided into two types: functional verification and timing fication. Functional verification only considers whether the logic functions of the design meet requirements and can be done by simulation or formal proof. Timing verification considers ther the design meets the timing constraints and can be performed using dynamic timing ulation or static timing analysis.
te-box testing techniques are used for analyzing application programmable logic during fication activities.
5.4.5.5          Implementation Phase V&V implementation phase review and analysis activities detect and report errors that may have n introduced during the coding process. Primary concerns include correctness of the code respect to programmable logic requirements, design, and conformance to coding standards.
NE Medical Technologies                    7.4-52                                        Rev. 4
* Compliance with programmable logic design
* Compliance with the programmable logic architecture
* Testability
* Conformance to standards
* Traceability
* Accuracy and consistency ification of the design can be divided into two types: functional verification and timing fication. Functional verification only considers whether the logic functions of the design meet requirements and can be done by simulation or formal proof. Timing verification considers ther the design meets the timing constraints and can be performed using dynamic timing ulation or static timing analysis.
te-box testing techniques are used for analyzing application programmable logic during fication activities.
5.4.5.6            Test Phase V&V purpose of the test phase V&V is to uncover errors that may have been introduced during development processes. Testing objectives include the development and execution of test es and procedures to verify the following:
* Code complies with the PLRS
* Code complies with the PLDS
* Code is robust
* Code complies with the target hardware ck-box testing techniques are used to execute functional checks on the system components ng system testing.
5.4.6          Configuration Management 5.4.6.1            Development Phase Configuration Management figuration management of the development of safety-related control systems has been gated to the vendor and is applied to data and documentation used to produce, verify, test, show compliance with the programmable logic used in the system. The programmable logic figuration management process is described in this subsection.
figuration identification is the first activity of configuration management. Configuration tification identifies items to be controlled, establishes identification schemes for the items their versions, and establishes the tools and methods to be used in acquiring and managing trolled items. Configuration identification provides a starting point for other configuration nagement activities. Configuration identification provides the ability to:
* Identify the components of the system throughout the development process, and
* Trace between the programmable logic and its development process data.
NE Medical Technologies                          7.4-53                                      Rev. 4
 
eval, tracking, reproduction, and distribution of configuration items. The following figuration items are identified and are placed under configuration management:
* Design input documents
* Design output documents
* SyRS
* System design specifications
* System hardware design specifications
* System hardware components
* Programmable logic requirements documents
* Programmable logic requirements models
* Programmable logic design models
* Programmable logic hardware description language code
* V&V data and documents
* Programmable logic development environment
* Change requests including customer deviation / exception requests and interim change notices
* Third-party vendor supplied documents
* Third-party vendor supplied software vendor Configuration Management Plan specifies a numbering scheme for project data and uments.
integrated development environment (IDE) tool is used to store and manage configuration
: s. Configuration items such as data, requirements, models, code files, reports, and tests are ed and placed under source control in the IDE tool. The IDE tool is used to perform the wing configuration management activities:
* Review changes in modified files
* Run impact analysis
* Run project integrity checks
* Commit modified files into source control
* Discard modifications made to committed files
* Retrieve configuration items from source control
* Revert to a previous version of a file
* View and report configuration item source control information figuration baselines are established at various points in the project. A baseline is the grammable logic and its data at a point in time. The baseline serves as a basis for further elopment. Once a baseline is established, changes can only be made through the change trol process described in the Configuration Management Plan.
elines are established after each development phase, at the completion of the formal review he V&V team. The following baselines are established:
* Requirements Baseline
* Design Baseline NE Medical Technologies                    7.4-54                                        Rev. 4
 
elining is performed by committing phase configuration items into source control and listing configuration item in the master configuration list, as specified in the vendor system design trol procedure. The project file contains and manages programmable logic configuration s in one project folder structure allowing committing of all project phase configuration items g one project file in the IDE tool.
aselined configuration item is traceable to the baselined configuration item from which it was eloped.
aselined configuration item is traceable to either the output it identifies or to the process with ch it is associated. The traceability of baselined configuration items is recorded in the system uirements traceability matrix.
proposed change to a baselined configuration item is subject to the change control and ew requirements in the Configuration Management Plan. The change in status is flagged in IDE tool and the file is baselined after the change control and review requirements are sfied.
e the configuration item is baselined, only authorized personnel can change the configuration
  . Changes to baselined configuration items are planned, documented, approved, and ked in accordance with a change control process.
IDE tool records each change to baselined configuration items, including who made the nge, and can discard changes that have been implemented or revert to any previous baseline r the changed configuration item has been baselined.
archival and retrieval process involves the storage of data so that it can be accessed by horized personnel. Project documents and records are retained and filed in the system gration document package and are stored in dual remote storage locations to preclude loss sed by natural disasters. The archival and retrieval process ensures:
* Accuracy and completeness
* Protection from unauthorized change
* Quality of storage media and protection from disaster
* Accuracy of retrieval and duplication grammable logic code load controls include approved load procedures, load verification, and marking verification.
programmable logic development environment includes the tools, methods, procedures, gramming languages, and hardware used to develop, verify, control, and produce the grammable logic. The tools identification data, including version numbers, are listed in the ster Configuration List.
NE Medical Technologies                    7.4-55                                        Rev. 4
 
nges to the development environment are subject to change control.
figuration reviews are required for configuration items prior to shipment. The configuration its include both document configuration items and programmable logic components.
figuration status accounting involves recording and reporting information that is needed to ctively manage the programmable logic configuration items development, verification, and dation processes. Reports are generated to inform managers, developers, and SHINE about project status. Configuration status accounting reports provide consistent, reliable, and timely us information that enhances communication, avoids duplication, and prevents repeat takes. The configuration status accounting reports provide the following information:
* Status of data items including configuration identification
* Status of change requests and test anomaly reports
* Status of released data and files
* List of baselined contents and differences from previous baseline figuration status accounting reports include the master configuration list, model development orts, and change request and test anomaly reports.
master configuration list identifies hardware part numbers and the programmable logic code ociated with the hardware. Before loading the code onto the hardware, the identification of the grammable logic code and the hardware is performed to ensure compatibility.
commercial off-the-shelf (COTS) vendor supplied documents or software are edited by the ty-related control system vendor project team. The document versions and software versions recorded upon receipt in the master configuration list and should not change. Therefore, her configuration change procedures nor baselining apply to COTS documents or software.
urchase order issued by the safety-related control system vendor to a third-party vendor for a TS program or technical calculations typically contains:
* a description of the major components of the software design, as they relate to the software requirements,
* a technical description of the software with respect to the theoretical basis, mathematical model, control flow, data flow, control logic, and data structure,
* a description of the allowable or prescribed ranges for inputs and outputs, and
* the design described in a manner that can be translated into code.
purchase order requires the vendor to provide a software design description and evidence of V.
third-party vendor software and documentation are verified for sufficiency such that a person is technically qualified in the subject is able to understand the third-party vendor deliverables verify the adequacy of the results without recourse to the originator.
NE Medical Technologies                      7.4-56                                        Rev. 4
 
figuration management of any post-installation changes or modifications required to the ty-related control systems has been delegated to the vendor. Processes equivalent to those d for initial development, described in Subsection 7.4.5.4.6.1, are followed. SHINE maintains rsight of the vendor, authorization of changes, control of the scope of changes, and luation of the change against the requirements of the SHINE facility license.
5.4.6.3          Configuration Management Compliance sions of software/firmware and documentation of specified hardware components are naged by the configuration management process to ensure the correct version of ware/firmware is installed in the correct hardware components.
5.4.7        Independent Testing elopment, review, and release of V&V generated test documents and execution of tests are ormed by the vendor in accordance with the system Test Plan and V&V Plan. V&V personnel responsible for hardware and software test setup. The test schedule is developed to ensure ect deliverables satisfy the system technical and regulatory requirements. The test tasks ude the following:
* Test plan development
* Pre-Factory Acceptance Test (FAT) procedures development
* FAT procedures development
* System requirements traceability matrix update
* Test equipment setup
* Pre-FAT test procedures execution
* Report pre-FAT results and update FAT documents
* FAT procedures execution
* Report FAT results
* Test phase V&V summary report development test documentation includes the following:
* Project test plan
* Test procedures
* Test scripts and test input stimulus files
* Test reports
* Test anomaly reports
* Test phase summary report ting is performed to ensure satisfactory hardware has been developed in accordance with the S. Measurement and test equipment calibration is performed before a testing activity and eable to National Institute of Standards and Technology (NIST) standards. Measures are n to establish that tools, gauges, instruments, and other measuring and testing devices used ctivities affecting quality are properly controlled, calibrated, and adjusted at specified periods aintain accuracy within acceptable limits. Testing activities include both pre-FAT and FAT.
NE Medical Technologies                      7.4-57                                        Rev. 4
 
FAT informally executes the FAT procedures to determine their suitability, correctness, pleteness, and efficiency of the test procedures.
FAT validates that the system hardware conforms to the system requirements as defined in SyRS and as documented in the system requirements traceability matrix.
FAT is performed on each protection system and includes integration tests and system tests.
nsists of a documented series of inspections, power-on tests, and calibration verification s to confirm that the system hardware conforms to the approved requirements and design uments and is in overall proper working order. It also verifies that the test configuration is ect and the required test equipment is properly calibrated.
FAT integration test cases and procedures perform the following:
* Test programmable logic interfaces and basic programmable logic operations, and
* Test interface characteristics defined in the requirements specifications and design description such as protocols, sequences, and timing.
FAT system test cases and procedures perform the following:
* Test system functions as defined in the SyRS
* Test voting functions
* Test trip or protective outputs
* Test system operation in all modes as defined in the SyRS mal and robustness test cases are prepared in the test procedures to demonstrate that ign outputs conform to requirements.
acceptance criteria for each testable requirement are specified in the applicable test case.
acceptance criteria are specified by either qualitative (pass/fail) or quantitative (numerical) eptance criteria. When an acceptance criterion is numerical, the minimum and maximum es are specified.
testable attribute that does not meet the stated acceptance criteria is documented on a Test maly Report. This includes both programmable logic anomalies and hardware deficiencies.
Test Anomaly Report identifies the resolution of the stated problem and describes any sting requirements.
results of the FAT are summarized in the FAT summary report and are incorporated into a arate test phase summary report, which is generated at the end of the test phase. The FAT mary report also incorporates other reports including test anomaly reports (used to ument deficiencies found during testing) and change requests as attachments.
FAT summary report documents the review of the test results with the following criteria:
: 1. Complete: Test cases and steps have been executed.
: 2. Acceptable: Results are within the expected results.
: 3. Anomalies resolved: Test anomaly reports have been resolved.
NE Medical Technologies                      7.4-58                                        Rev. 4
 
and tested.
re is no process risk associated with either the system test plan or implementation of the ted FAT. The FAT is conducted using simulated inputs, using either measurement and test ipment generated signals or computer-based test systems. The outputs are not connected to plant process equipment, but are connected to displays, measurement and test equipment, omputer-based indication and data collection equipment. No equipment is operated outside esign parameters; therefore, there is no expectation of equipment failure. The only risks ociated with the system test plan are schedule compliance and satisfaction of test eptance criteria.
5.4.8        Project Risk Management vendor Project Management Plan describes the risk management activities for the project.
risk management approach consists of five activities:
: 1. Risk identification
: 2. Risk analysis
: 3. Risk mitigation planning
: 4. Risk mitigation implementation
: 5. Risk tracking and control k identification activities occur throughout the project lifecycle. Identified risks are umented in a safety-related control system vendor project risk register, which includes a cription of the risk, areas of concern, likelihood, mitigating actions, and possible sequences. The project risk register may also describe the impacts to stakeholders, umptions, constraints, relationship to other project risks, possible alternatives, as well as acts to the project budget, schedule, or deliverables.
h identified risk is analyzed to determine the type and the extent of the impacts should the situation or event occur. The analysis considers several relevant factors and includes any umptions made, constraints, and sensitivity of the risk item.
k mitigation planning involves developing plans for mitigation and/or contingency actions for a cific risk. The risk mitigation plans address topics such as:
* Identification of mitigation and contingency actions for funding, schedule, staff, or resources
* Identification of actions to be taken to reduce the likelihood or consequences of impact on the project
* Determination of the planned response based on a cost/benefit analysis
* Assignment of responsibility for each mitigation and contingency action k tracking, monitoring, and control assess how the project risk profile is changing throughout project lifecycle, as well the effectiveness of any mitigation/contingency plans that have been cuted. When changes to the risk occur, the process to identify, analyze, and plan is repeated.
sting risk mitigation plans are modified to change the approach if the desired effect is not g achieved.
NE Medical Technologies                      7.4-59                                      Rev. 4
 
S system performance is addressed in Subsection 7.4.4.
gnostic and maintenance features provided by the HIPS platform features include the use of T, cyclic redundancy checks (CRC), periodic surveillance testing, and other tests in each type odule, as appropriate, to verify normal operation. Attributes of the system incorporate the nostic and maintenance principles outlined in Section 8.0 of Topical Report TR-1015-18653 Scale, 2017).
self-testing features of the HIPS platform are designed, developed, and validated at the e level as the functional logic. The overlapped self-test features of the HIPS platform are gral to the operation of the system and are therefore designed, developed, and validated to same rigor as the rest of the platform.
ting from the sensor inputs of the TRPS and ESFAS through to the actuated equipment is omplished through a series of overlapping sequential tests, most of which may be performed ng normal plant operations. Performance of periodic surveillance testing does not involve onnecting wires or installation of jumpers for at-power testing. The self-test features maintain sion independence by being performed within the division.
TRPS and ESFAS incorporate failure detection and isolation techniques. Fault detection and cation occurs at the module level, which enables plant personnel to identify the module that ds to be replaced. Self-testing will generate an alarm and report a failure to the operator and e the component (e.g., SFM, SBVM, or EIM components) in a fail-safe state.
MWS is used to perform modification of configurable variables and setpoints and in-chassis bration of TRPS and ESFAS equipment as described in Subsection 7.4.5.3.3.
6        CONCLUSION safety-related TRPS is designed to specific and measurable criteria to ensure quality and quacy in the system design, implementation, and maintenance.
ign basis functions ensure safe operation of the facility and prevent or mitigate sequences of design basis events.
HIPS platform used in the TRPS design is based on fundamental instrumentation and trol principles of independence, redundancy, predictability and repeatability, and diversity and developed under quality management to provide a simple yet reliable solution for the safety-ted TRPS functions.
NE Medical Technologies                    7.4-60                                        Rev. 4
 
Table 7.4 TRPS Monitored Variables (Sheet 1 of 2)
Instrument Variable                    Analytical Limit          Logic                Range            Accuracy    Response Time 2.52 times the nominal Source range neutron flux    flux at 95 percent volume          2/3          1 to 1.0E+05 cps      2 percent  450 milliseconds of the critical fill height Wide range neutron flux              240 percent              2/3        2.5E-8 to 250 percent    2 percent  450 milliseconds Power range neutron flux        [            ]PROP/ECI        2/3 (Low power range limit, driver 40 percent              2/3          0 to 125 percent      1 percent      1 second opout permissive, and high time-averaged limit)                  104 percent              2/3 RVZ1e IU cell exhaust radiation  15x background radiation          2/3          10-7 to 10-1 µCi/cc    20 percent    15 seconds TOGS oxygen concentration                10 percent              2/3            0 to 25 percent      1 percent    120 seconds TOGS mainstream flow            [              ]PROP/ECI        2/3      [                ]PROP/ECI  3 percent    1.5 seconds TOGS dump tank flow              [          ]PROP/ECI          2/3      [                ]PROP/ECI  3 percent    1.5 seconds OGS condenser demister outlet 25°C                  2/3              0 to 100°C        0.65 percent  10 seconds temperature Discrete Low-high TSV dump tank level              High level              2/3      High level/not high level                1.5 seconds input signal Discrete High-high TSV dump tank level              High level              2/3      High level/not high level                1.5 seconds input signal PCLS flow                  [        ]PROP/ECI          2/3      [                ]PROP/ECI  1 percent      1 second 15°C                  2/3 PCLS temperature                                                                -1 to 121°C        1 percent    10 seconds 25°C                  2/3 NE Medical Technologies                                          7.4-61                                                          Rev. 4
 
Instrument Variable            Analytical Limit  Logic      Range          Accuracy    Response Time TSV fill isolation valve position                                              Discrete Not closed      1/2  Closed/not closed                0.5 seconds indication                                                        input signal Discrete ESFAS loss of external power      Loss of power    1/1 Power/loss of power                0.5 seconds input signal NE Medical Technologies                            7.4-62                                            Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 1 of 14)
SHINE Medical Technologies                                    7.4-63                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 2 of 14)
SHINE Medical Technologies                                    7.4-64                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 3 of 14)
SHINE Medical Technologies                                    7.4-65                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 4 of 14)
SHINE Medical Technologies                                    7.4-66                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 5 of 14)
SHINE Medical Technologies                                    7.4-67                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 6 of 14)
SHINE Medical Technologies                                    7.4-68                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 7 of 14)
SHINE Medical Technologies                                    7.4-69                                                        Rev. 4
 
Chapter 7 - Instrumentation and Control Systems                                                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 8 of 14)
Deliberate operator action, TSV dump valves closed, One or Two TSV fill valves closed, and                                    Mode 1                            Deliberate operator action TOGS mainstream flow is above                                      Startup - Fill                        and One or Two TSV fill minimal flow rates                                                                                  valves closed Manual Or Auto IU Cell Safety Actuation, Manual Or Mode 0                                                    Auto IU Cell Nitrogen Purge Solution                                                  Or Facility Operating                      Mode 2 Removed                                                    Permissive removed                        Irradiation Manual Or Auto IU Cell Safety Actuation, Manual Or Auto IU Cell Nitrogen Purge Or Facility Operating Permissive Manual Or Auto IU Cell Safety                          removed Actuation, Manual Or Auto IU Cell                                                    Deliberate operator Nitrogen Purge, Or Facility Operating                                                  action and HVPS Permissive Removed                                                            breakers open Deliberate operator action and no target                    Mode 4                                                    Mode 3 solution in dump                  Transfer to                                                  Post tank                          RPF                                                    Irradiation                    Facility Operating Permissive removed Deliberate operator action, no IU Cell Safety Actuation Facility Operating NOTE: LOGIC SHOWN IS IMPLEMENTED IN ALL                                    Permissive DIVISION A AND DIVISION B SCHEDULING, BYPASS,                                  engaged                            Mode 3 AND VOTING MODULES Secure State SHINE Medical Technologies                                                            7.4-70                                                                  Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 9 of 14)
SHINE Medical Technologies                                    7.4-71                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 10 of 14)
SHINE Medical Technologies                                    7.4-72                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 11 of 14)
SHINE Medical Technologies                                    7.4-73                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 12 of 14)
SHINE Medical Technologies                                    7.4-74                                                        Rev. 4
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 13 of 14)
SHINE Medical Technologies                                    7.4-75                                                        Rev. 4
 
Chapter 7 - Instrumentation and Control Systems                                                              Target Solution Vessel Reactivity Protection System Figure 7.4-1 TRPS Logic Diagrams (Sheet 14 of 14)
PROCESS INTEGRATED CONTROL SYSTEM NS  NEUTRON FLUX SOURCE RANGE A                                ALARM POINT INDICATION PROVIDED TO PROCESS I                                                      NW      NEUTRON FLUX WIDE RANGE                                SIGNAL JUNCTION INTEGRATED CONTROL SYSTEM LOGICAL OR GATE          NP    NEUTRON FLUX POWER RANGE                                NO JUNCTION OR AND                          LOGICAL AND GATE          LS            LEVEL SWITCH ACRONYMS NOT      OR          LOGICAL NOT OR INVERTER GATE    HT      HYDROGEN TRANSMITTER APL - ACTUATION AND PRIORITY LOGIC DIV - DIVISION XOR                        LOGICAL XOR GATE          OT        OXYGEN TRANSMITTER EIM - EQUIPMENT INTERFACE MODULE HVPS - HIGH VOLTAGE POWER SUPPLY XNOR                        LOGICAL XNOR GATE          TT        TRITIUM TRANSMITTER HWMI - HARDWIRED MODULE INPUT IU - IRRADIATION UNIT 2/3                  TWO-OUT-OF-THREE VOTING GATE        FT        FLOW TRANSMITTER N2PS - NITROGEN PURGE SYSTEM PICS - PROCESS INTEGRATED CONTROL SYSTEM 2/2                  TWO-OUT-OF-TWO VOTING GATE        TE      TEMPERATURE ELEMENT PCLS - PRIMARY CLOSED LOOP COOLING SYSTEM BISTABLE - INCREASING SETPOINT                                        RPCS - RADIOISOTOPE PROCESS FACILITY COOLING SYSTEM PT        PRESSURE TRANSMITTER OR DISCRETE ACTIVE                                            RPF - RADIOISOTOPE PRODUCTION FACILITY BISTABLE - DECREASING SETPOINT OR                                        RVZ - RADIOLOGICAL VENTILATION ZONE ZI  DISCREET POSITION INDICATION DISCRETE INACTIVE                                            SCAS - SUBCRITICAL ASSEMBLY SYSTEM SBM - SCHEDULING AND BYPASS MODULE PB                              PUSH BUTTON            RM        RADIATION MONITOR SBVM - SCHEDULING, BYPASS, AND VOTING MODULE SFM - SAFETY FUNCTION MODULE HS              TWO POSITION HAND SWITCH                DI          DISCRETE INPUT TOGS - TSV OFF-GAS SYSTEM TIMER THAT INITIATES ON A LOGIC 1, RESETS ON T = XX                                                                                    TPS - TRITIUM PURIFICATION SYSTEM LOGIC 0 AND OUTPUTS A LOGIC 1 IF TIMER    CF      COMPENSATED FLOW seconds                      HAS EXPIRED                                                    TSV - TARGET SOLUTION VESSEL Xs Timer                                                                                    LSB - LEAST SIGNIFICANT BIT UNIQUE TIMER LOGIC, SEE NOTES        (A)      AUTOMATIC ACTUATION Logic                                                                                      NDAS - NEUTRON DRIVER ASSEMBLY SYSTEM XX Second      AVERAGE OPERATOR OVER XX AMOUNT          (M)        MANUAL ACTUATION Average                          OF TIME (E)      ENABLE NONSAFETY ENABLED (D)      ENABLE NONSAFETY DISABLED SHINE Medical Technologies                                                              7.4-76                                                                    Rev. 4
 
NE Medical Technologies 7.4-77 Rev. 4 Chapter 7 - Instrumentation and Control Systems                        Target Solution Vessel Reactivity Protection System Figure 7.4 TRPS and ESFAS Programmable Logic Lifecycle Process SHINE Medical Technologies                              7.4-78                                                      Rev. 4
 
1        SYSTEM DESCRIPTION engineered safety features actuation system (ESFAS) is a single, safety-related rumentation and control (I&C) system that provides monitoring and actuation functions ughout the SHINE main production facility.
ESFAS performs various detection, logic processing, control, and actuation functions dited by the SHINE safety analysis described in Chapter 13 as required to prevent the urrence or mitigate the consequences of design basis events within the main production lity. The ESFAS provides sense, command, and execute functions necessary to maintain the lity confinement strategy and provides process actuation functions required to shut down cesses and maintain processes in a safe condition. The ESFAS also provides nonsafety-ted system status and measured process variable values to the facility process integrated trol system (PICS) for viewing, recording, and trending.
ESFAS monitors variables important to the safety functions for confinement of radiation and m within the irradiation facility (IF) and the radioisotope production facility (RPF) and for cality safety to perform the following functions:
* Radiologically Controlled Area (RCA) Isolation
* Supercell Isolation
* Carbon Delay Bed Isolation
* Vacuum Transfer System (VTS) Safety Actuation
* Tritium Purification System (TPS) Train Isolation
* TPS Process Vent Actuation
* Irradiation Unit (IU) Cell Nitrogen Purge
* RPF Nitrogen Purge
* Molybdenum Extraction and Purification System (MEPS) Heating Loop Isolation
* Extraction Column Alignment Actuation
* Iodine and Xenon Purification and Packaging (IXP) Alignment Actuation
* Dissolution Tank Isolation ESFAS monitors the IF and the RPF continually throughout the operation of processes in the main production facility, via the use of radiation monitoring and other instrumentation.
rlocks and bypass logic necessary for operation are implemented within the ESFAS. If at any t a monitored variable exceeds its predetermined limits, the ESFAS automatically initiates associated safety function. ESFAS logic diagrams are provided in Figure 7.5-1 and the eral architecture of the ESFAS is provided in Figure 7.1-3.
ESFAS is built using the highly integrated protection system (HIPS) platform as described in section 7.4.5. ESFAS equipment is separated into three divisions (A, B, and C). The ESFAS undantly receives safety-related inputs from field instrumentation (input devices) to either two sions (A and B) or all three divisions, dependent on the input variable. The input signals are vided to the ESFAS safety function modules (SFMs). More than one input device provides a al to each SFM. The inputs are allocated to the different SFMs within a division as described e technical specifications. Each SFM can be placed in maintenance bypass or in a trip state se of the out-of-service (OOS) switch located on the front of the SFM and an associated bypass switch located below the SFM, as described in Subsection 7.5.4.4. Placing an SFM in NE Medical Technologies                        7.5-1                                        Rev. 5
 
ESFAS bypass logic is implemented in all three divisions using scheduling, bypass, and ng modules (SBVMs) for divisions A and B, or scheduling and bypass modules (SBMs) for sion C. The ESFAS voting and actuation logic is implemented in only divisions A and B. For sions A and B, the three SBVMs, in each division, generate actuation signals when the SFMs ny two of three (or one of two) divisions determine that an actuation is required. Both ESFAS sions A and B evaluate the input signals from the SFMs in each of three redundant SBVMs.
h SBVM compares the inputs received from the SFMs and generates an appropriate ation signal if required by two or more of the three (or one or more of the two) divisions.
output of the three redundant SBVMs in divisions A and B is communicated via three pendent safety data buses to the associated equipment interface modules (EIMs). There are independent EIMs for each actuation component, associated with each division A and B of FAS. The EIMs compare inputs from the three SBVMs and initiate an actuation if two out of e signals agree on the need to actuate. Both EIMs associated with a component are required e deenergized for the actuation component(s) to fail to their actuated (deenergized) states, the exception of the process vessel vent system (PVVS) carbon delay bed three-way and et isolation valves (Subsections 7.5.3.1.14, 7.5.3.1.15, and 7.5.3.1.16). These valves are rgized to actuate.
2        DESIGN CRITERIA SHINE facility design criteria applicable to the ESFAS are stated in Table 3.1-1. The facility ign criteria applicable to the ESFAS, and the ESFAS system design criteria, are addressed in section.
ESFAS utilizes a HIPS design. The HIPS design is applicable to both the target solution sel (TSV) reactivity protection system (TRPS) and the ESFAS. The HIPS design is described ubsection 7.4.5.
2.1        SHINE Facility Design Criteria generally-applicable SHINE facility design criteria 1 through 6 apply to the ESFAS. The FAS is designed, fabricated, and erected to quality standards commensurate to the safety tions to be performed; will perform these safety functions during external events; will perform e safety functions within the environmental conditions associated with normal operation, ntenance, and testing; does not share components between irradiation units unless that ring will not significantly impair the ability to perform the required safety functions; and is able e manually initiated from the facility control room. These elements of the ESFAS design tribute to satisfying SHINE facility design criteria 1 through 6.
NE facility Design Criteria 13 through 19 and 37 through 39 also apply to the ESFAS.
2.1.1      Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and NE Medical Technologies                        7.5-2                                        Rev. 5
 
its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
ESFAS monitored variables for performance of design basis functions are presented in le 7.5-1 and include the instrument range for covering normal and accident conditions, the uracy for each variable, the response time, and the analytical limit. Subsection 7.5.4.1 vides a discussion of each of these variables, including details on how they are maintained in the prescribed operating range.
2.1.2        Protection System Functions SHINE Design Criterion 14 - The protection systems are designed to: (1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and (2) sense accident conditions and to initiate the operation of safety-related systems and components.
re are no anticipated transients that require the initiation of the ESFAS to ensure specified eptable target solution design limits (Table 4a2.2-2) are not exceeded.
ration of the ESFAS in response to the analyzed events is presented in Subsection 7.5.4.1.
section describes the parameters monitored to sense accident conditions and automatic tem response to actuation setpoints in monitored variables. Subsection 7.5.3.1 contains a cription of the ESFAS safety functions relied upon for specific accident scenarios and onstrates that the ESFAS is able to sense accident conditions and initiate the operation of ty-related systems and components.
2.1.3        Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.
Redundancy and independence designed into the protection systems are sufficient to ensure that: (1) no single failure results in loss of the protection function, and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.
HIPS platform design for the ESFAS supports high functional reliability, in part, by rporating predictability and repeatability principles to ensure an extremely high probability of omplishing safety functions, as described in Subsection 7.4.5.2.3. High functional reliability is her addressed in SHINE Design Criterion 19 (Subsection 7.5.2.1.7).
ESFAS contains capabilities for inservice testing for those functions that cannot be tested e the associated equipment is out of service (Subsection 7.5.4.5).
NE Medical Technologies                      7.5-3                                        Rev. 5
 
bsection 7.4.5.2.1).
undancy within the ESFAS, as described in Subsection 7.4.5.2.2, consists of two or three sions of input processing and trip determination (dependent on the monitored variable) and divisions of actuation logic arranged such that no single failure can prevent a safety actuation n required (Subsection 7.5.3.3). This was validated by the performance of a single failure lysis of the ESFAS, performed in accordance with IEEE Standard 379-2000 (IEEE, 2000), as cribed in Subsection 7.4.5.2.2.
hannel of ESFAS can be taken out of service by placing the channel in trip or using the ntenance bypass function, as described in Subsection 7.5.4.4. A channel can be taken to trip out an adverse impact on redundancy, as described in Subsection 7.5.4.4.
maintenance bypass function allows an individual safety function module to be removed service in accordance with the technical specifications, for the purpose of performing uired technical specification surveillance testing (Subsection 7.5.4.4). A time limit of two hours cceptable based on the small amount of time the channel could be in bypass, the continual ndance by operations or maintenance personnel during the test, the continued operability of redundant channel(s), and the low likelihood that an accident would occur during the two r time period. By allowing a single SFM module to be placed in maintenance bypass in ordance with the technical specifications, technical specifications surveillances can be ormed to verify the operability of ESFAS components during system operation, which ports in-service testability.
-test features are provided for components that do not have setpoints or tunable parameters.
discrete logic of the actuation and priority logic (APL) of the EIM does not have self-test ability but is instead functionally tested (Subsection 7.5.4.5). Calibration, testing, and nostics are addressed in Section 8.0 of Topical Report TR-1015-18653 (NuScale, 2017).
-testing capabilities provide indication of component degradation and failure, which allows on to be taken to ensure that no single failure results in the loss of the protection function.
2.1.4        Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels, do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.
ESFAS control and logic functions operate inside of the facility control room where the ironment is mild, not exposed to the irradiation process, and is protected from earthquakes, adoes, and floods (Subsections 7.5.3.4 and 7.5.3.5). The ESFAS structures, systems, and ponents that comprise a division are physically separated to retain the capability of orming the required safety functions during a design basis accident. Division independence aintained throughout, extending from the sensor to the devices actuating the protective tion (Subsection 7.4.5.2.1).
NE Medical Technologies                      7.5-4                                        Rev. 5
 
ys (FPGAs) in each division are of a different physical architecture to prevent common cause re (Subsection 7.4.5.2.4).
2.1.5        Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.
trolled components associated with safety actuations are designed to go to their safe state n deenergized (Table 7.5-2). The ESFAS equipment is qualified for radiological and ironmental hazards present during normal operation and postulated accidents bsection 7.5.3.4). A failure modes and effects analysis (FMEA) was performed which verified there are no single failures or non-detectable failures that can prevent the ESFAS from orming its required safety function (Subsection 7.4.5.2.2).
2.1.6        Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.
re are no sensor outputs that have both an ESFAS safety-related protection function and a safety-related control function. There are no inputs to the ESFAS from the PICS that are d in the determination of protective actions. Since there are no inputs from the PICS that act a safety function in the ESFAS, and no sensors that provide both a safety-related ection function and a nonsafety-related control function, a failure or removal from service of single protection system component or channel leaves intact a system satisfying the bility, redundancy, and independence requirements of the ESFAS as described in sections 7.4.5.2.1, 7.4.5.2.2, 7.4.5.2.3, 7.5.3.3, and 7.5.4.4.
safety-related inputs to the ESFAS from the PICS are limited to those for controls and nitoring and indication only variables and are further described in Subsection 7.5.3.3. A failure hese nonsafety inputs will not impede the ESFAS from performing its safety function because safety function is prioritized over the nonsafety input as described in Subsection 7.5.3.11.
limitation of inputs and prioritization of the safety function ensures that interconnection of the FAS and PICS is limited to assure that safety is not significantly impaired.
2.1.7        Protection Against Anticipated Transients SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.
application of the HIPS platform to the ESFAS ensures an extremely high probability of omplishing the required safety functions by applying the attributes of independence, NE Medical Technologies                        7.5-5                                        Rev. 5
 
uring an extremely high probability of accomplishing safety functions by ensuring that ctures, systems, and components that comprise a division are physically separated.
ependence is further described in Subsection 7.4.5.2.1. Redundancy principles contribute to uring an extremely high probability of accomplishing safety functions by ensuring that no le failure can prevent a safety actuation, as described in Subsections 7.4.5.2.2 and 7.5.3.3.
dictability and repeatability principles contribute to ensuring an extremely high probability of omplishing safety functions by ensuring the ESFAS produces the same outputs for a given of input signals within well-defined response time limits. Predictability and repeatability is her described in Subsection 7.4.5.2.3.
2.1.8        Criticality Control in the Radioisotope Production Facility SHINE Design Criterion 37 - Criticality in the radioisotope production facility is prevented by physical systems or processes and the use of administrative controls. Use of geometrically safe configurations is preferred. Control of criticality adheres to the double contingency principle. A criticality accident alarm system to detect and alert facility personnel of an inadvertent criticality is provided.
ESFAS provides two safety functions as required by the SHINE criticality safety program cribed in Section 6b.3. The VTS Safety Actuation safety function stops the transfer of target tion or other radioactive solutions upon indication of potential upset conditions bsection 7.5.3.1.17). Actuation on a VTS vacuum header liquid detection switch signal ects against an overflow of the vacuum lift tanks and potential criticality event bsection 7.5.4.1.8). The Dissolution Tank Isolation safety function protects against a criticality nt due to excess fissile material in a non-favorable geometry system (Subsection 7.5.4.1.18) prevents overflow of the dissolution tank into the uranium handling glovebox or ventilation tem.
2.1.9        Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
ESFAS monitors for potential radioactivity releases from various areas of the SHINE main duction facility. The ESFAS monitors radiation in the radiological ventilation zone 1 (RVZ1) or ological ventilation zone 2 (RVZ2) facility exhaust (Subsection 7.5.3.1.24), radiation from the et of each cell of the supercell (Subsections 7.5.3.1.1 through 7.5.3.1.10), and tritium from tritium purification system glovebox (Subsections 7.5.3.1.18, 7.5.3.1.19, and 7.5.3.1.20).
itional radioactivity release monitoring is provided by the TRPS (Section 7.4) and by safety-related radiation monitoring systems (Section 7.7). The radiation release monitoring vided by the TRPS, ESFAS, and nonsafety-related radiation monitoring systems provides nitoring for potential effluent discharge paths and plant environs that may be released from mal operations, including anticipated transients, and from postulated accidents.
NE Medical Technologies                      7.5-6                                        Rev. 5
 
SHINE Design Criterion 39 - Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries is maintained.
ESFAS monitors variables and provides actuations to protect against hydrogen deflagration arious areas in the SHINE main production facility. The TRPS IU cell nitrogen purge signal ects against a loss of hydrogen mitigation capabilities in the IUs (Subsection 7.5.4.1.14). The PVVS flow signal protects against a loss of hydrogen mitigation capabilities in the RPF bsection 7.5.4.1.15). The uninterruptible electrical power supply system (UPSS) loss of rnal power signal protects against an anticipatory loss of hydrogen mitigation in the IU cell bsection 7.5.4.1.19).
2.2        ESFAS System Design Criteria 2.2.1      Access Control ESFAS Criterion 1 - The ESFAS shall require a key or combination authentication input at the control console to prevent unauthorized use of the ESFAS.
ESFAS utilizes a HIPS design which is described in Subsection 7.4.5. Unauthorized use of ESFAS is prevented by required use of a physical key as described in the HIPS design bsection 7.4.5.3.3).
ESFAS Criterion 2 - Developmental phases for ESFAS software shall address the potential cyber security vulnerabilities (physical and electronic) to prevent unauthorized physical and electronic access.
ESFAS development design uses the process described in Subsection 7.4.5.3.1 to prevent uthorized physical and electronic access during the development phases.
ESFAS Criterion 3 - The ESFAS design shall incorporate design or administrative controls to prevent/limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.
ess control features prevent unauthorized physical and electronic access to CDAs during the rational phase and during transition from development to operations. Access control, cyber urity, and the secure development operating environment are described in section 7.4.5.3. Subsection 7.4.5.3 describes prevention of unauthorized access during the elopment and operational phases. Post-development installation and testing is performed controlled by the safety-related control system vendor as described in section 7.4.5.4.2.6.
NE Medical Technologies                    7.5-7                                        Rev. 5
 
ESFAS Criterion 4 - The functional characteristics of the ESFAS software requirements specifications shall be properly and precisely described for each software requirement.
programmable logic design requirements are specified in the programmable logic uirements specifications (PLRS), which are generated in accordance with the vendor grammable logic development lifecycle (Subsection 7.4.5.4.2). A programmable logic design cification (PLDS) is generated to define the programmable logic design details.
grammable logic development is addressed in Subsection 7.4.5.4.
ESFAS Criterion 5 - Development of ESFAS software shall follow a formally defined lifecycle process and address potential security vulnerabilities in each phase of the lifecycle.
programmable logic lifecycle process is described in Subsection 7.4.5.4.2. The lifecycle cess includes a Project Security Plan as stated in Subsection 7.4.5.4.2.1. The development cess addresses security vulnerabilities (physical and electronic) in the developmental phases he software and addresses controls to prevent unauthorized physical and electronic access.
grammable logic lifecycle activities are performed within a secure development environment g an isolated development network (Subsections 7.4.5.3.1 and 7.4.5.4.2.2).
ESFAS Criterion 6 - ESFAS development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the ESFAS.
grammable logic lifecycle activities necessitate use of a secure development environment g an isolated development network from the Requirements Phase forward bsection 7.4.5.4.2.2). Software requirements development, including lifecycle phase-specific urity requirements, is addressed in ESFAS Criterion 5.
ESFAS Criterion 7 - ESFAS software development lifecycle process requirements shall be described and documented in appropriate plans which shall address safety analysis, verification and validation (V&V), and configuration control activities.
programmable logic lifecycle process for the ESFAS includes development of a grammable Logic Development Plan (PLDP), V&V Plan, and Configuration Management n to control programmable logic development and its associated safety analysis, V&V, and figuration management activities (Subsection 7.4.5.4.2.1).
ESFAS Criterion 8 - Tasks for validating and verifying the ESFAS software development activities shall be carried out in their entirety. Independent V&V tasks shall be performed by individuals or groups with appropriate technical competence in an organization separate from the development and program management organizations. Successful completion of V&V tasks for each software lifecycle activity group shall be documented.
NE has delegated V&V activities related to the safety-related control system development, uding V&V documentation, to the vendor. The vendor Project V&V Plan for the system elopment was tailored and adapted for FPGA technology from the guidance in IEEE NE Medical Technologies                      7.5-8                                      Rev. 5
 
ESFAS Criterion 9 - The ESFAS software lifecycle configuration control program shall trace software development from software requirement specification to implementation and address any impacts on ESFAS safety, control console, or display instruments.
programmable logic lifecycle process includes development of a Configuration Management n (Subsection 7.4.5.4.6) to control tracing of programmable logic development from uirements specifications to implementation and address any impacts on ESFAS grammable logic functions. The configuration control process as it relates to control consoles display instruments, which are part of the nonsafety-related PICS, is described in section 7.6.2.2.2. The SHINE configuration management program will ensure consistency ong the design requirements between ESFAS and PICS.
ESFAS Criterion 10 - The ESFAS configuration control program shall assure that the required ESFAS hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.
section 7.4.5.4.6.3 addresses compliance with ESFAS Criterion 10 and ensures the correct sion of software/firmware is installed in the correct hardware components. The development se configuration management process is described in Subsection 7.4.5.4.6.1 and states that ponents of the system (hardware) and programmable logic and its development process a (software) are controlled by the Project Configuration Management Plan. Post-installation se configuration management is addressed in Subsection 7.4.5.4.6.2.
ESFAS Criterion 11 - Qualification testing shall test all portions of ESFAS programmable logic necessary to accomplish its safety functions, and shall exercise those portions whose operation or failure could impair safety functions during testing.
lementation phase V&V activities (Subsection 7.4.5.4.5.5) verify the design accuracy to omplish safety functions and include functional verification and timing verification activities.
t phase V&V (Subsection 7.4.5.4.5.6) includes system functional, interface, and performance ing.
ESFAS Criterion 12 - The ESFAS software development lifecycle shall include a software risk management program which addresses vulnerabilities throughout the software lifecycle.
vendor utilizes a Project Risk Management Plan for development of the ESFAS, as cribed in Subsection 7.4.5.4.8. Risk identification activities occur throughout the project ycle. Identified risks are documented in a project risk register and actions are developed to ress identified risks or vulnerabilities.
ESFAS Criterion 13 - ESFAS equipment not designed under a SHINE approved quality assurance (QA) program shall be qualified under the SHINE commercial-grade dedication program.
developmental process for creating the safety-related ESFAS has been delegated to NE's safety-related control system vendor (Subsection 7.4.5.3.1), including any modifications NE Medical Technologies                    7.5-9                                        Rev. 5
 
roved quality and procurement documents, and maintaining the vendor as an approved plier on the SHINE approved supplier list (Subsection 7.4.5.4.1).
2.2.3        General Instrumentation and Control Requirements ESFAS Criterion 14 - The ESFAS safety functions shall perform and remain functional during normal operation and during and following a design basis event.
ESFAS equipment is installed in the seismically qualified portion of the main production lity where it is protected from earthquakes, tornadoes, and floods. The ESFAS equipment is smic Category I, designed in accordance with Section 8 of IEEE Standard 344-2013 E, 2013) (Subsections 7.5.3.4 and 7.5.3.5). The ESFAS control and logic equipment is ted in a mild operating environment inside the facility control room, protected from ological and environmental hazards during normal operation, maintenance, testing, and tulated accidents, and cables and sensors outside the facility control room are designed for r respective environments (Subsection 7.5.3.4). The ESFAS is qualified for a mild operating ironment by applying the guidance of Sections 4.1, 5.1, 6.1, and 7 of IEEE ndard 323-2003 (IEEE, 2003b).
ESFAS Criterion 15 - Manual controls of ESFAS actuation components shall be implemented downstream of the digital I&C portions of the safety system.
ESFAS logic diagrams (Figure 7.5-1) display where the manual actuation is brought into the
: c. Manual controls and nonsafety control system inputs come individually into the APL and downstream of the programmable logic portion of the ESFAS architecture shown in ure 7.1-3 (Subsection 7.4.5.2.4).
2.2.4        Single Failure ESFAS Criterion 16 - The ESFAS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the ESFAS, and such failure shall not prevent the ESFAS and credited redundant passive control components from performing the intended functions or prevent safe shutdown of an IU cell.
ESFAS consists of three divisions of input processing and trip determination and two sions of actuation logic arranged such that no single failure within the ESFAS results in the of the protective function. Redundancy is addressed in Subsection 7.4.5.2.2. Nonsafety-ted inputs into the ESFAS are designed and controlled so they do not prevent the ESFAS performing its safety functions. Single failure is additionally addressed in section 7.5.3.3.
modes of single system component failures and satisfaction of the single failure criterion e evaluated for the ESFAS using an FMEA and single failure analysis. The FMEA determined there are no single failures or non-detectable failures that can prevent the ESFAS from orming its required safety functions. The single failure analysis determined that for functions uiring either one-out-of-two voting or two-out-of-three voting, a single failure of a channel will prevent a protective action when required. Additional discussion of the FMEA and single re analysis is provided in Subsection 7.4.5.2.2.
NE Medical Technologies                      7.5-10                                      Rev. 5
 
ESFAS is comprised of three divisions of signal conditioning and trip determination, and two sions of voting and actuation. This configuration allows for the architecture to handle a single re of a field input, signal conditioning circuit, or trip determination and still maintain the ability rovide the needed number of valid inputs to the voting circuitry. A single failure of the voting c or the actuation logic is also acceptable within the configuration as the redundant division of ng logic and actuation logic is capable of performing the safety function. Functional pendence is addressed in Subsection 7.4.5.2.1 and redundancy is addressed in section 7.4.5.2.2. Single failure is additionally addressed in Subsection 7.5.3.3.
modes of single system component failures and satisfaction of the single failure criterion e evaluated for the ESFAS using an FMEA and single failure analysis. The FMEA determined there are no single failures or non-detectable failures that can prevent the ESFAS from orming its required safety functions. The single failure analysis determined that for functions uiring either one-out-of-two voting or two-out-of-three voting, a single failure of a channel will prevent a protective action when required. Additional discussion of the FMEA and single re analysis is provided in Subsection 7.4.5.2.2.
ESFAS Criterion 18 - The ESFAS shall be designed so that no single failure within the instrumentation or power sources concurrent with failures as a result of a design basis event should prevent operators from being presented the information necessary to determine the safety status of the facility following the design basis event.
ESFAS provides independent, redundant communication paths to the PICS display systems each of the three ESFAS divisions. ESFAS divisions A and B are powered from a separate sion of the UPSS; ESFAS division C receives auctioneered power from both UPSS divisions nd B. This redundancy in communication paths and power sources ensures no single failure current with a design basis event prevents operators from being presented necessary rmation (Subsection 7.5.3.3). Display of monitoring and indication information in the facility trol room is described in Subsection 7.4.5.2.4. Loss of external power to the PICS is cribed in Subsection 7.3.3.6. An FMEA and single failure analysis, as described in section 7.4.5.2.2, determined no single failure would impact the ability of the ESFAS to vide information to the PICS.
2.2.5        Independence ESFAS Criterion 19 - Interconnections among ESFAS safety divisions shall not adversely affect the functions of the ESFAS.
ety-related inputs to the ESFAS which originate within a specific division of the ESFAS are t to, and processed in, only the same division prior to being provided to any other division of system for voting purposes (Subsection 7.4.5.2.1).
ESFAS Criterion 20 - A logical or software malfunction of any interfacing nonsafety systems shall not affect the functions of the ESFAS.
APL, which is constructed of discrete components and part of the equipment interface dule, is designed to provide priority to safety-related signals over nonsafety-related signals.
NE Medical Technologies                      7.5-11                                            Rev. 5
 
rity than the previous: (1) Automatic Safety Actuation, Manual Safety Actuation, and (2) PICS safety control signals (Subsection 7.5.3.11). When the enable nonsafety control is not active, nonsafety-related control signals are ignored. If the enable nonsafety control is active, and no omatic safety actuation or manual safety actuation command is present, the nonsafety control al can control the component (Subsection 7.5.3.2).
ESFAS Criterion 21 - The ESFAS shall be designed with physical, electrical, and communications independence of the ESFAS both between the ESFAS channels and between the ESFAS and nonsafety-related systems to ensure that the safety functions required during and following any design basis event can be accomplished.
ESFAS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related ESFAS inputs and outputs are ed in non-divisional cable raceways and are segregated from safety-related inputs and puts (Subsection 7.5.3.8). Wiring for redundant divisions uses physical separation and ation to provide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008). HIPS communication paths are designed such that a single re does not cause all safety functions of a division to be inoperable (Subsection 7.4.4.1.2).
ESFAS Criterion 22 - Physical separation and electrical isolation shall be used to maintain the independence of ESFAS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any design basis event can be accomplished.
ESFAS structures, systems, and components that comprise a division are physically arated to retain the capability of performing the required safety functions during a design is accident (Subsection 7.4.5.2.1) and nonsafety-related ESFAS inputs and outputs are ed in non-divisional cable raceways and are segregated from safety-related inputs and puts (Subsection 7.5.3.8). Wiring for redundant divisions uses physical separation and ation to provide independence for circuits (Subsection 7.4.5.2.1) in accordance with IEEE ndard 384-2008 (IEEE, 2008).
ESFAS Criterion 23 - The ESFAS shall be designed such that no communication - within a single safety channel, between safety channels, and between safety and nonsafety systems - adversely affects the performance of required safety functions.
S communication paths are designed with simplicity such that a single failure does not cause afety functions of a division to be inoperable. The design uses triple redundant munication paths. A single failure does not cause all safety functions of that division to be erable (Subsection 7.4.4.1.2). Communication ports that are for communication outside of a S chassis implement the one-way communication with hardware (Subsection 7.4.5.3.2).
ESFAS Criterion 24 - ESFAS data communications protocols shall meet the performance requirements of all supported systems.
NE Medical Technologies                    7.5-12                                          Rev. 5
 
unidirectional. Data communications are discussed in Subsection 7.4.5.2.5.
ESFAS Criterion 25 - The timing of ESFAS data communications shall be deterministic.
ESFAS implements deterministic data communications, as described in section 7.4.5.2.5.
ESFAS Criterion 26 - ESFAS communications protocols shall conform to validated protocol specifications by formally generated test procedures and test data vectors and verify that the implementations themselves were constructed using a formal design process that ensures consistency between the product and the validated specification.
FAS communication protocols are verified as conforming to the validated protocol cifications by the Project V&V Plan (Subsection 7.4.5.4.5).
ESFAS Criterion 27 - The ESFAS shall be designed such that no unexpected performance deficits exist in the communication protocol that could adversely affect the ESFAS architecture.
communications independence, the ESFAS platform is designed such that each safety sion functions independently of other safety divisions. With the exception of interdivisional ng, communication within a division does not rely on communication outside the respective sion to perform the safety function. Safety-related inputs to the ESFAS which originate within ecific division of the ESFAS are input to, and processed in, only the same division prior to g provided to any other division of the system for voting purposes (Subsection 7.4.5.2.1).
ESFAS platform operates in a fully deterministic manner, as described in section 7.4.5.2.5, which allows implementation of a simple communication protocol using a defined message structure at fixed time intervals. This ensures that a consistency of ormance will exist that prevents performance deficits from adversely affecting the ESFAS hitecture.
2.2.6        Prioritization of Functions ESFAS Criterion 28 - ESFAS devices that receive signals from safety and nonsafety sources shall prioritize the signal from the safety system.
rity is provided to automatic and manual safety-related actuation signals over nonsafety-ted signals as described in Subsection 7.5.3.11.
2.2.7        Fail-Safe ESFAS Criterion 29 - The ESFAS shall be designed to assume a safe state on loss of electrical power.
trolled components associated with safety actuations are designed to go to their safe state n deenergized (Subsection 7.5.3.7). ESFAS outputs become deenergized on a loss of trical power to the ESFAS.
NE Medical Technologies                    7.5-13                                      Rev. 5
 
ESFAS Criterion 30 - Setpoints for an actuation of the ESFAS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.
points in the ESFAS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.5.3.10. Environmental allowances measurement computational errors are accounted for in the uncertainty analysis used to blish the setpoints. The setpoint analysis parameters in the documented analyses are sistent with the safety analysis, system design basis, technical specifications, facility design, expected maintenance practices.
ESFAS Criterion 31 - Adequate margin shall exist between setpoints and safety limits so that the ESFAS initiates protective actions before safety limits are exceeded.
points in the ESFAS are based on a documented methodology that ensures adequate margin ts between setpoints and analytical limits or safety limits. The setpoint methodology is further cribed in Subsections 7.2.1 and 7.5.3.10. The established setpoints and associated ertainties ensure adequate margin to analytical limits or safety limits described in the nical specifications.
ESFAS Criterion 32 - Where it is necessary to provide multiple setpoints for adequate protection based on particular modes of operation or sets of operating conditions, the ESFAS shall provide positive means of ensuring that the more restrictive setpoint is used when required.
re are no safety functions in the ESFAS that use multiple setpoints.
ESFAS Criterion 33 - The sensitivity of each ESFAS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.
points in the ESFAS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsections 7.2.1 and 7.5.3.10. Setpoint analysis ameters typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and putational errors. The established setpoints and associated uncertainties ensure adequate gin to analytical limits or safety limits described in the technical specifications, which ensures the sensitivity of each sensor channel is commensurate with the knowledge of the variable.
2.2.9        Operational Bypass, Permissives and Interlocks ESFAS Criterion 34 - Permissive conditions for each ESFAS operating or maintenance bypass capability shall be documented.
NE Medical Technologies                        7.5-14                                        Rev. 5
 
ration in the normal, unsecured mode or operationally secured (Subsection 7.5.4.3). A ntenance bypass function is available, as described in Subsection 7.5.4.4. There are no missive conditions associated with the maintenance bypass capability.
ESFAS Criterion 35 - ESFAS interlocks shall ensure that operator actions cannot defeat an automatic safety function during any operating condition where that safety function may be required, with the exception of the use of the maintenance bypass capability.
ESFAS has no operational bypasses included in the design, and therefore no interlocks are uired to prevent operator actions from defeating an automatic safety function bsection 7.5.4.2). There are not automatic interlocks to prevent an operator from putting all rument channels in maintenance bypass (Subsection 7.5.4.4). Administrative controls are vided by the technical specifications to prevent placing the same SFM across more than one nnel in maintenance bypass.
ESFAS Criterion 36 - ESFAS provisions shall exist to prevent activation of an operating bypass unless applicable permissive conditions exist.
re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). PICS inputs may bypassed with the enable nonsafety switch, as described in Subsection 7.5.3.2.
ESFAS Criterion 37 - Bypass capability shall not be provided for the mechanisms to manually initiate ESFAS safety functions.
nual safety actuations are shown in the logic diagrams (Figure 7.5-1). There are no conditions allow manually initiated ESFAS safety functions to be bypassed.
ESFAS Criterion 38 - If provisions for maintenance or operating bypasses are provided, the ESFAS design shall retain the capability to accomplish its safety function while a bypass is in effect.
re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). Use of the ntenance bypass is performed in accordance with technical specification requirements bsection 7.5.4.4).
ESFAS Criterion 39 - Whenever permissive conditions for bypassing a train or channel in the ESFAS are not met, a feature in the ESFAS shall physically prevent or facilitate administrative controls to prevent the unauthorized use of bypasses.
re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). A maintenance ass function is available, as described in Subsection 7.5.4.4. There are no permissive ditions associated with the maintenance bypass capability.
ESFAS Criterion 40 - All ESFAS operating bypasses, either manually or automatically initiated, shall be automatically removed when the facility moves to an operating regime where the protective action would be required if an accident occurred.
re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2).
NE Medical Technologies                  7.5-15                                      Rev. 5
* Remove the appropriate active operating bypass(es)
* Restore conditions so that permissive conditions once again exist
* Initiate the appropriate safety function(s) re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2).
ESFAS Criterion 42 - Portions of ESFAS that execute features with a degree of redundancy of one shall be designed so that when a portion is placed in maintenance bypass (i.e.,
reducing temporarily its degree of redundancy to zero), the remaining portions provide acceptable reliability to perform the ESFAS action if required.
re are no maintenance bypass capabilities associated with execute features for the ESFAS.
maintenance bypass capabilities are associated with the sense and command features only.
ntenance bypass capabilities and their acceptability for use are further discussed in section 7.5.4.4.
ESFAS Criterion 43 - Provisions shall exist to allow the operations staff to confirm that a bypassed ESFAS safety function has been properly returned to service.
re are no operational bypasses in the ESFAS design (Subsection 7.5.4.2). Any ESFAS nnels placed in maintenance bypass for maintenance or testing, or removed from ntenance bypass, will be displayed redundantly to the operators in the facility control room ugh the monitoring and indication bus to the PICS (Subsection 7.5.4.4). The PICS is cribed in Section 7.3 and operator displays and human factors considerations are addressed ection 7.6.
2.2.10        Completion of Protective Actions ESFAS Criterion 44 - The ESFAS design shall ensure that once initiated the safety actions will continue until the protective function is completed.
ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS. Completion of ective actions is described in Subsection 7.5.3.2.
ESFAS Criterion 45 - Only deliberate operator action shall be permitted to reset the ESFAS or its components following manual or automatic actuation.
y deliberate operator action can be taken to reset the ESFAS following a protective action.
ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS. Completion of ective actions is described in Subsection 7.5.3.2.
ESFAS Criterion 46 - Mechanisms for deliberate operator intervention in the ESFAS status or its functions shall not be capable of preventing the initiation of ESFAS actions.
NE Medical Technologies                      7.5-16                                      Rev. 5
 
ble nonsafety switch is active, and no automatic safety actuation or manual safety actuation als are present, the operator is capable of energizing or deenergizing any EIM outputs using nonsafety-related hardwired control signals (Subsection 7.5.3.2). Additionally, safety-related als are prioritized over nonsafety-related signals (Subsection 7.5.3.11).
2.2.11        Equipment Qualification ESFAS Criterion 47 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges, such as high-energy faults and lightning, on the ESFAS, including field programmable gate array (FPGA)-based digital portions, shall be adequately addressed.
FAS rack mounted equipment is installed in a mild operating environment and is designed to et the environmental conditions described in Subsection 7.5.3.4. Rack mounted ESFAS ipment is tested to appropriate standards to show that the effects of EMI/RFI and power ges are adequately addressed. This testing includes emissions testing, susceptibility testing, surge withstand testing. Appropriate grounding of the ESFAS is performed in accordance Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).
2.2.12        Surveillance ESFAS Criterion 48 - Equipment in the ESFAS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the ESFAS shall retain the capability to accomplish its safety function while under test.
ESFAS design supports testing, maintenance, and calibration to ensure operability as cribed in Subsections 7.5.4.4 and 7.5.4.5. Surveillance testing performed using the ntenance bypass capability during operation is controlled in accordance with the technical cifications to ensure that the ESFAS is capable of performing its safety functions when uired (Subsection 7.5.4.4). Self-testing features provide for monitoring as described in section 7.5.4.5 to provide indication to the operator if conditions exist that could challenge rability of the equipment.
ESFAS Criterion 49 - Testing, calibration, and inspections of the ESFAS shall be sufficient to show that once performed, they confirm that surveillance test and self-test features address failure detection, self-test features, and actions taken upon failure detection.
ESFAS design supports testing, maintenance, and calibration, as described in sections 7.5.4.4 and 7.5.4.5. End-to-end testing of the entire ESFAS platform can be ormed through overlap testing. ESFAS components have self-testing capabilities, except the rete APL of the EIM which is functionally tested. The ESFAS continuously provides undant indication of self-testing results to the PICS to indicate to operators that the ESFAS is rating correctly following testing, calibration, or inspections.
ESFAS Criterion 50 - The design of the ESFAS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.
NE Medical Technologies                      7.5-17                                        Rev. 5
 
bsection 7.5.4.6). The capabilities for testing in the design of the ESFAS support the testing rvals in the technical specifications.
2.2.13        Classification and Identification ESFAS Criterion 51 - ESFAS equipment shall be distinctly identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.
h ESFAS cable and component is uniquely identified in accordance with SHINE component bering guidelines. By identifying the specific component associated with the ESFAS, the ty classification can be determined. The unique identification number indicates the licable system and division (Subsection 7.5.3.9).
2.2.14        Human Factors ESFAS Criterion 52 - Human factors shall be considered at the initial stages and throughout the ESFAS design process to ensure that the functions allocated in whole or in part to the operator(s) can be successfully accomplished to meet ESFAS design goals.
man factors is a design consideration for development of the ESFAS. Changes to the design ughout the lifecycle process include human factors considerations (Subsection 7.4.5.4.2).
man factors design is described in Subsection 7.5.3.6.
ESFAS Criterion 53 - The ESFAS shall include readily available means for manual initiation of each protective function at the system level.
ESFAS provides manual safety actuation capability as shown in the logic diagrams.
ure 7.5-1 displays where the manual actuation is brought into the logic. Human factors design upport of manual initiation is described in Subsection 7.5.3.6.
ESFAS Criterion 54 - The ESFAS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator and requiring manual operator reset when all conditions to resume operation are met and satisfied.
ESFAS includes redundantly isolated outputs for each safety-related instrument channel to vide monitoring and indication information to the PICS (Subsection 7.5.3.6), which includes cation of ESFAS actuation device status. This supports annunciation of the channel initiating otective action. The ESFAS requires manual operator reset when conditions to resume ration are met and satisfied as described in ESFAS Criterion 45 (Subsection 7.5.2.2.10).
2.2.15        Quality ESFAS Criterion 55 - The quality of the components and modules in the ESFAS shall be commensurate with the importance of the safety function to be performed.
safety-related ESFAS is designed, fabricated, erected, and tested by SHINEs safety-related trol system vendor in accordance with the vendors Project Quality Assurance Plan NE Medical Technologies                      7.5-18                                      Rev. 5
 
ESFAS Criterion 56 - Controls over the design, fabrication, installation, and modification of the ESFAS shall conform to the guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010).
ESFAS design, fabrication, installation, and modification is performed in accordance with a lity assurance program which conforms to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS,
: 5) as endorsed by Regulatory Guide 2.5 (USNRC, 2010) (Subsection 7.5.3.12).
3        DESIGN BASIS ESFAS monitors process variables and provides automatic initiating signals in response to normal conditions, providing protection against unsafe conditions in the main production lity.
section 7.5.4 addresses the specific variables that provide input into the ESFAS, the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time. The conditions or operating modes applicable to each able monitored by the ESFAS are described in the technical specifications.
3.1          Safety Functions ESFAS is a plant level control system not specific to any operating unit or process, figured as shown in Figure 7.1-3 The facility operating conditions applicable to each omatic ESFAS safety function listed in this subsection are specified in the technical cifications.
3.1.1        Supercell Area 1 (PVVS Area) Isolation ercell Area 1 (PVVS Area) Isolation is relied upon as a safety-related control for radioactivity ase scenarios similar to those described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3), and to provide for a consistent confinement strategy for all ten s of the supercell.
upercell Area 1 (PVVS Area) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 1 (PVVS area) inlet isolation dampers
* Deenergize RVZ1 supercell area 1 (PVVS area) outlet isolation dampers
* VTS Safety Actuation which returns the VTS to atmospheric pressure ESFAS initiates a Supercell Area 1 (PVVS Area) Isolation based on the following variable or ty actuation:
* High RVZ1 supercell area 1 (PVVS) exhaust ventilation radiation
* RCA Isolation NE Medical Technologies                    7.5-19                                        Rev. 5
 
ercell Area 2 (Extraction Area A) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).
upercell Area 2 (Extraction Area A) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 2 (extraction area A) inlet isolation dampers
* Deenergize RVZ1 supercell area 2 (extraction area A) outlet isolation dampers
* MEPS A Heating Loop Isolation
* VTS Safety Actuation ESFAS initiates a Supercell Area 2 (Extraction Area A) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 2 (extraction A) exhaust ventilation radiation
* RCA Isolation 3.1.3      Supercell Area 3 (Purification Area A) Isolation ercell Area 3 (Purification Area A) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.
upercell Area 3 (Purification Area A) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 3 (purification area A) inlet isolation dampers
* Deenergize RVZ1 supercell area 3 (purification area A) outlet isolation dampers ESFAS initiates a Supercell Area 3 (Purification Area A) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 3 (purification A) exhaust ventilation radiation
* RCA Isolation 3.1.4      Supercell Area 4 (Packaging Area 1) Isolation ercell Area 4 (Packaging Area 1) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.
upercell Area 4 (Packaging Area 1) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 4 (packaging area 1) inlet isolation dampers
* Deenergize RVZ1 supercell area 4 (packaging area 1) outlet isolation dampers NE Medical Technologies                      7.5-20                                        Rev. 5
* High RVZ1 supercell area 4 (packaging 1) exhaust ventilation radiation
* RCA Isolation 3.1.5      Supercell Area 5 (Purification Area B) Isolation ercell Area 5 (Purification Area B) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.
upercell Area 5 (Purification Area B) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 5 (purification area B) inlet isolation dampers
* Deenergize RVZ1 supercell area 5 (purification area B) outlet isolation dampers ESFAS initiates a Supercell Area 5 (Purification Area B) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 5 (purification B) exhaust ventilation radiation
* RCA Isolation 3.1.6      Supercell Area 6 (Extraction Area B) Isolation ercell Area 6 (Extraction Area B) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).
upercell Area 6 (Extraction Area B) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 6 (extraction area B) inlet isolation dampers
* Deenergize RVZ1 supercell area 6 (extraction area B) outlet isolation dampers
* MEPS B Heating Loop Isolation
* VTS Safety Actuation ESFAS initiates a Supercell Area 6 (Extraction Area B) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 6 (extraction B) exhaust ventilation radiation
* RCA Isolation
* Supercell Area 10 (IXP area) Isolation 3.1.7      Supercell Area 7 (Extraction Area C) Isolation ercell Area 7 (Extraction Area C) Isolation is relied upon as a safety-related control in ordance with the SHINE safety analysis described in Chapter 13 for RPF critical equipment function events (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13).
NE Medical Technologies                      7.5-21                                        Rev. 5
* Deenergize RVZ2 supercell area 7 (purification area C) inlet isolation dampers
* Deenergize RVZ1 supercell area 7 (purification area C) outlet isolation dampers
* MEPS C Heating Loop Isolation
* VTS Safety Actuation ESFAS initiates a Supercell Area 7 (Extraction Area C) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 7 (extraction C) exhaust ventilation radiation
* RCA Isolation
* Supercell Area 10 (IXP area) Isolation 3.1.8      Supercell Area 8 (Purification Area C) Isolation ercell Area 8 (Purification Area C) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.
upercell Area 8 (Purification Area C) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 8 (purification area C) inlet isolation dampers
* Deenergize RVZ1 supercell area 8 (purification area C) outlet isolation dampers ESFAS initiates a Supercell Area 8 (Purification Area C) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 8 (purification C) exhaust ventilation radiation
* RCA Isolation 3.1.9      Supercell Area 9 (Packaging Area 2) Isolation ercell Area 9 (Packaging Area 2) Isolation is relied upon as a safety-related control for oactivity release scenarios similar to those described in Chapter 13 for RPF critical ipment malfunction events (Subsection 13b.1.2.3), and to provide for a consistent finement strategy for all ten cells of the supercell.
upercell Area 9 (Packaging Area 2) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 9 (packaging area 2) inlet isolation dampers
* Deenergize RVZ1 supercell area 9 (packaging area 2) outlet isolation dampers ESFAS initiates a Supercell Area 9 (Packaging Area 2) Isolation based on the following able or safety actuation:
* High RVZ1 supercell area 9 (packaging 2) exhaust ventilation radiation
* RCA Isolation NE Medical Technologies                      7.5-22                                        Rev. 5
 
ercell Area 10 (IXP Area) Isolation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenarios 4, 5, 6, and 7).
upercell Area 10 (IXP Area) Isolation initiates the following safety functions:
* Deenergize RVZ2 supercell area 10 (IXP area) inlet isolation dampers
* Deenergize RVZ1 supercell area 10 (IXP area) outlet isolation dampers
* Supercell Area 6 (extraction area B) Isolation
* Supercell Area 7 (extraction area C) Isolation ESFAS initiates a Supercell Area 10 (IXP Area) Isolation based on the following variable or ty actuation:
* High RVZ1 supercell area 10 (IXP) exhaust ventilation radiation
* RCA Isolation 3.1.11      MEPS A Heating Loop Isolation PS A Heating Loop Isolation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenario 14).
EPS A Heating Loop Isolation initiates the following safety functions:
* Deenergize MEPS heating loop A inlet isolation valves
* Deenergize MEPS heating loop A discharge isolation valves
* Deenergize MEPS A extraction feed pump breakers ESFAS initiates a MEPS A Heating Loop Isolation based on the following variables or safety ation:
* High MEPS heating loop radiation extraction area A
* Radioactive drain system (RDS) liquid detection
* Supercell Area 2 Isolation 3.1.12      MEPS B Heating Loop Isolation PS B Heating Loop Isolation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenario 14).
EPS B Heating Loop Isolation initiates the following safety functions:
* Deenergize MEPS heating loop B inlet isolation valves
* Deenergize MEPS heating loop B discharge isolation valves
* Deenergize MEPS B extraction feed pump breakers NE Medical Technologies                    7.5-23                                      Rev. 5
* High MEPS heating loop radiation extraction area B
* RDS liquid detection
* Supercell Area 6 Isolation 3.1.13      MEPS C Heating Loop Isolation PS C Heating Loop Isolation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenario 14).
EPS C Heating Loop Isolation initiates the following safety functions:
* Deenergize MEPS heating loop C inlet isolation valves
* Deenergize MEPS heating loop C discharge isolation valves
* Deenergize MEPS C extraction feed pump breakers ESFAS initiates a MEPS C Heating Loop Isolation based on the following variables or safety ation:
* High MEPS heating loop radiation extraction area C
* RDS liquid detection
* Supercell Area 7 Isolation 3.1.14      Carbon Delay Bed Group 1 Isolation bon Delay Bed Group 1 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).
arbon Delay Bed Group 1 Isolation initiates the following safety functions:
* Energize PVVS carbon delay bed group 1 three-way valves
* Energize PVVS carbon delay bed group 1 outlet isolation valves ESFAS initiates a Carbon Delay Bed Group 1 Isolation based on the following variable:
* High carbon delay bed group 1 exhaust carbon monoxide 3.1.15      Carbon Delay Bed Group 2 Isolation bon Delay Bed Group 2 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).
NE Medical Technologies                  7.5-24                                      Rev. 5
* Energize PVVS carbon delay bed group 2 three-way valves
* Energize PVVS carbon delay bed group 2 outlet isolation valves ESFAS initiates a Carbon Delay Bed Group 2 Isolation based on the following variable:
* High carbon delay bed group 2 exhaust carbon monoxide 3.1.16      Carbon Delay Bed Group 3 Isolation bon Delay Bed Group 3 Isolation is relied upon as a safety-related control in accordance with SHINE safety analysis described in Chapter 13 for RPF fire events (Subsection 13b.1.2.5, nario 1).
arbon Delay Bed Group 3 Isolation initiates the following safety functions:
* Energize PVVS carbon delay bed group 3 three-way valves
* Energize PVVS carbon delay bed group 3 outlet isolation valves ESFAS initiates a Carbon Delay Bed Group 3 Isolation based on the following variable:
* High carbon delay bed group 3 exhaust carbon monoxide 3.1.17      VTS Safety Actuation Safety Actuation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16), and for criticality safety requirements bsection 6b.3.2.5).
TS Safety Actuation Isolation initiates the following safety functions:
* Deenergize VTS vacuum transfer pump 1 breakers
* Deenergize VTS vacuum transfer pump 2 breakers
* Deenergize VTS vacuum break valves
* Deenergize MEPS A extraction column wash supply valve
* Deenergize MEPS A extraction column eluent valve
* Deenergize MEPS A [                          ]PROP/ECI wash supply valve
* Deenergize MEPS A [                          ]PROP/ECI eluent valve
* Deenergize MEPS B extraction column wash supply valve
* Deenergize MEPS B extraction column eluent valve
* Deenergize MEPS B [                          ]PROP/ECI wash supply valve
* Deenergize MEPS B [                          ]PROP/ECI eluent valve
* Deenergize MEPS C extraction column wash supply valve
* Deenergize MEPS C extraction column eluent valve
* Deenergize MEPS C [                          ]PROP/ECI wash supply valve
* Deenergize MEPS C [                          ]PROP/ECI eluent valve
* Deenergize IXP recovery column wash supply valve
* Deenergize IXP recovery column eluent valve NE Medical Technologies                    7.5-25                                        Rev. 5
* Deenergize IXP facility nitrogen handing system (FNHS) supply valve
* Deenergize IXP liquid nitrogen supply valve ESFAS initiates a VTS Safety Actuation based on the following variables or safety ations:
* VTS vacuum header liquid detection
* RDS liquid detection
* Supercell Area 1 Isolation
* Supercell Area 2 Isolation
* Supercell Area 6 Isolation
* Supercell Area 7 Isolation
* RCA Isolation
* Facility master operating permissive 3.1.18        TPS Train A Isolation Train A Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),
for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).
PS Train A Isolation initiates the following safety functions:
* Deenergize TPS train A glovebox pressure control exhaust isolation valves
* Deenergize vacuum/impurity treatment subsystem (VAC/ITS) train A process vent ITS isolation valves (TPS train A ITS isolation valves)
* Deenergize TPS train A helium supply isolation valve
* Deenergize RVZ2 TPS room supply isolation dampers
* Deenergize RVZ2 TPS room exhaust isolation dampers
* Deenergize VAC/ITS train A process vent vacuum isolation valves (TPS train A vacuum isolation valves)
* Deenergize IU Cell 1 TPS Actuation
* Deenergize IU Cell 2 TPS Actuation ESFAS initiates a TPS Train A Isolation based on the following variables or safety actuation:
* High TPS IU cell 1 target chamber supply pressure
* High TPS IU cell 2 target chamber supply pressure
* High TPS IU cell 1 target chamber exhaust pressure
* High TPS IU cell 2 target chamber exhaust pressure
* High TPS confinement A tritium
* RCA Isolation
* Facility master operating permissive NE Medical Technologies                        7.5-26                                  Rev. 5
 
Train B Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),
for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).
PS Train B Isolation initiates the following safety functions:
* Deenergize TPS train B glovebox pressure control exhaust isolation valves
* Deenergize VAC/ITS train B process vent ITS isolation valves (TPS train B ITS isolation valves)
* Deenergize TPS train B helium supply isolation valve
* Deenergize RVZ2 TPS room supply isolation dampers
* Deenergize RVZ2 TPS room exhaust isolation dampers
* Deenergize VAC/ITS train B process vent vacuum isolation valves (TPS train B vacuum isolation valves)
* TRPS IU Cell 3 TPS Actuation
* TRPS IU Cell 4 TPS Actuation
* TRPS IU Cell 5 TPS Actuation ESFAS initiates a TPS Train B Isolation based on the following variables or safety actuation:
* High TPS IU cell 3 target chamber supply pressure
* High TPS IU cell 4 target chamber supply pressure
* High TPS IU cell 5 target chamber supply pressure
* High TPS IU cell 3 target chamber exhaust pressure
* High TPS IU cell 4 target chamber exhaust pressure
* High TPS IU cell 5 target chamber exhaust pressure
* High TPS confinement B tritium
* RCA Isolation
* Facility master operating permissive 3.1.20        TPS Train C Isolation Train C Isolation is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 3),
for facility specific tritium purification system events (Subsection 13a2.1.12, TPS nario 1).
PS Train C Isolation initiates the following safety functions:
* Deenergize TPS train C glovebox pressure control exhaust isolation valves
* Deenergize VAC/ITS train C process vent ITS isolation valves (TPS train C ITS isolation valves)
* Deenergize TPS train C helium supply isolation valve
* Deenergize RVZ2 TPS room supply isolation dampers
* Deenergize RVZ2 TPS room exhaust isolation dampers
* Deenergize VAC/ITS train C process vent vacuum isolation valves (TPS train C vacuum isolation valves)
NE Medical Technologies                        7.5-27                                  Rev. 5
* TRPS IU Cell 8 TPS Actuation ESFAS initiates a TPS Train C Isolation based on the following variables or safety actuation:
* High TPS IU cell 6 target chamber supply pressure
* High TPS IU cell 7 target chamber supply pressure
* High TPS IU cell 8 target chamber supply pressure
* High TPS IU cell 6 target chamber exhaust pressure
* High TPS IU cell 7 target chamber exhaust pressure
* High TPS IU cell 8 target chamber exhaust pressure
* High TPS confinement C tritium
* RCA Isolation
* Facility master operating permissive 3.1.21        TPS Process Vent Actuation Process Vent Actuation is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for facility specific tritium purification system nts (Subsection 13a2.1.12, TPS Scenario 3 and TPS Scenario 4).
PS Process Vent Actuation initiates the following safety functions:
* Deenergize TPS train A vacuum isolation valves
* Deenergize TPS train A ITS isolation valves
* Deenergize TPS train B vacuum isolation valves
* Deenergize TPS train B ITS isolation valves
* Deenergize TPS train C vacuum isolation valves
* Deenergize TPS train C ITS isolation valves
* TRPS IU Cell 1 TPS Actuation
* TRPS IU Cell 2 TPS Actuation
* TRPS IU Cell 3 TPS Actuation
* TRPS IU Cell 4 TPS Actuation
* TRPS IU Cell 5 TPS Actuation
* TRPS IU Cell 6 TPS Actuation
* TRPS IU Cell 7 TPS Actuation
* TRPS IU Cell 8 TPS Actuation ESFAS initiates a TPS Process Vent Actuation based on the following variables or safety ation:
* High TPS exhaust to facility stack tritium
* RCA Isolation
* Facility master operating permissive 3.1.22        IU Cell Nitrogen Purge Cell Nitrogen Purge transitions the nitrogen purge system (N2PS) IU cell header valves to r deenergized state.
NE Medical Technologies                      7.5-28                                        Rev. 5
 
ate an IU Cell Nitrogen Purge within the TRPS (Subsection 7.4.3.1.2).
IU Cell Nitrogen Purge is relied upon as a safety-related control in accordance with the NE safety analysis described in Chapter 13 for insertion of excess reactivity events bsection 13a2.1.12, Scenario 5), and detonation and deflagration in the primary system ndary (Subsection 13a2.1.9, Scenario 1).
ESFAS initiates an IU Cell Nitrogen Purge based on the following variables:
* UPSS loss of external power
* TRPS IU Cell 1 Nitrogen Purge signal
* TRPS IU Cell 2 Nitrogen Purge signal
* TRPS IU Cell 3 Nitrogen Purge signal
* TRPS IU Cell 4 Nitrogen Purge signal
* TRPS IU Cell 5 Nitrogen Purge signal
* TRPS IU Cell 6 Nitrogen Purge signal
* TRPS IU Cell 7 Nitrogen Purge signal
* TRPS IU Cell 8 Nitrogen Purge signal 3.1.23      RPF Nitrogen Purge RPF Nitrogen Purge is relied upon as a safety-related control in accordance with the SHINE ty analysis described in Chapter 13 for external events (Subsection 13a2.1.6, Scenario 7).
F Nitrogen Purge initiates the following safety functions:
* Deenergize PVVS blower bypass valves
* Deenergize radioactive liquid waste immobilization (RLWI) PVVS isolation valve
* Deenergize PVVS carbon guard bed bypass valves
* Deenergize N2PS RPF header valves
* Deenergize N2PS PVVS north header valves
* Deenergize N2PS PVVS south header valves ESFAS initiates an RPF Nitrogen Purge based on the following variable:
* Low PVVS flow 3.1.24      RCA Isolation RCA Isolation is relied upon as a safety-related control in accordance with the SHINE safety lysis described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16).
A Isolation initiates the following safety functions:
* Deenergize RVZ1 RCA exhaust isolation dampers
* Deenergize RVZ2 RCA exhaust isolation dampers
* Deenergize RVZ2 RCA supply isolation dampers NE Medical Technologies                    7.5-29                                    Rev. 5
* Deenergize RVZ2 main RCA ingress/egress supply isolation dampers
* Deenergize RVZ2 main RCA ingress/egress exhaust isolation dampers
* Deenergize RVZ3 transfer isolation dampers shipping/receiving IF
* Deenergize RVZ3 transfer isolation dampers shipping/receiving RPF
* Deenergize RVZ3 transfer isolation dampers RPF emergency exit
* Deenergize RVZ3 transfer isolation dampers IF emergency exit
* Deenergize RVZ3 transfer isolation dampers mezzanine emergency exit
* Deenergize RVZ1 exhaust train 1 blower breakers
* Deenergize RVZ1 exhaust train 2 blower breakers
* Deenergize RVZ2 exhaust train 1 blower breakers
* Deenergize RVZ2 exhaust train 2 blower breakers
* Deenergize RVZ2 supply train 1 blower breakers
* Deenergize RVZ2 supply train 2 blower breakers
* Supercell Area 1 Isolation
* Supercell Area 2 Isolation
* Supercell Area 3 Isolation
* Supercell Area 4 Isolation
* Supercell Area 5 Isolation
* Supercell Area 6 Isolation
* Supercell Area 7 Isolation
* Supercell Area 8 Isolation
* Supercell Area 9 Isolation
* Supercell Area 10 Isolation
* VTS Safety Actuation
* TPS Train A Isolation
* TPS Train B Isolation
* TPS Train C Isolation
* TPS Process Vent Actuation ESFAS initiates an RCA Isolation based on the following variables:
* High RVZ1 RCA exhaust radiation
* High RVZ2 RCA exhaust radiation 3.1.25    Extraction Column A Alignment Actuation action Column A Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).
Extraction Column A Alignment Actuation initiates the following safety functions:
* Deenergize MEPS area A extraction column upper three-way valve
* Deenergize MEPS area A extraction column lower three-way valve
* Deenergize MEPS A extraction column eluent valve NE Medical Technologies                  7.5-30                                        Rev. 5
* MEPS area A extraction column upper three-way valve position indication in supplying
* MEPS area A extraction column lower three-way valve position indication in supplying 3.1.26    Extraction Column B Alignment Actuation action Column B Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).
Extraction Column B Alignment Actuation initiates the following safety functions:
* Deenergize MEPS area B extraction column upper three-way valve
* Deenergize MEPS area B extraction column lower three-way valve
* Deenergize MEPS B extraction column eluent valve ESFAS initiates the Extraction Column B Alignment Actuation when both of the following ditions are met:
* MEPS area B extraction column upper three-way valve position indication in supplying
* MEPS area B extraction column lower three-way valve position indication in supplying 3.1.27    Extraction Column C Alignment Actuation action Column C Alignment Actuation is relied upon as a safety-related control in accordance the SHINE safety analysis described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3, Scenario 15).
Extraction Column C Alignment Actuation initiates the following safety functions:
* Deenergize MEPS area C extraction column upper three-way valve
* Deenergize MEPS area C extraction column lower three-way valve
* Deenergize MEPS area C extraction column eluent valve ESFAS initiates the Extraction Column C Alignment Actuation when both of the following ditions are met:
* MEPS area C extraction column upper three-way valve position indication in supplying
* MEPS area C extraction column lower three-way valve position indication in supplying 3.1.28    IXP Alignment Actuation IXP Alignment Actuation is relied upon as a safety-related control for column misalignment narios similar to those described in Chapter 13 for RPF critical equipment malfunction events bsection 13b.1.2.3, Scenario 15).
NE Medical Technologies                  7.5-31                                        Rev. 5
* Deenergize IXP upper three-way valve
* Deenergize IXP lower three-way valve
* Deenergize IXP recovery column eluent valve ESFAS initiates the IXP Alignment Actuation when both of the following conditions are met:
* IXP upper three-way valve position indication in supplying
* IXP lower three-way valve position indication in supplying 3.1.29      Dissolution Tank Isolation solution Tank Isolation is relied upon as a safety-related control for preventing criticality nts (Subsection 6b.3.2.4).
issolution Tank Isolation initiates the following safety functions:
* Deenergize target solution preparation system (TSPS) radioisotope process facility cooling system (RPCS) supply cooling valves
* Deenergize TSPS RPCS return cooling valve
* Deenergize TSPS air inlet isolation valve
* Deenergize TSPS RVZ1 exhaust isolation valve ESFAS initiates the Dissolution Tank Isolation based on the following variables:
* High TSPS dissolution tank 1 level
* High TSPS dissolution tank 2 level 3.2        Completion of Protective Actions ESFAS is designed so that once initiated, protective actions will continue to completion. Only berate operator action can be taken to reset the ESFAS following a protective action.
ure 7.5-1 shows how the ESFAS latches in a protective action and maintains the state of a ective action until operator input is initiated to reset the output of the ESFAS to normal rating conditions.
output of the ESFAS is designed so that actuation through automatic or manual means of a ty function can only change when a new position is requested. If there is no signal present the automatic safety actuation or manual actuation, then the output of the EIM remains in its ent state. An enable nonsafety switch allows an operator, after the switch has been brought nable, to control the output state of the ESFAS with a hardwired binary control signal from the safety-related controls. The enable nonsafety switch is used to prevent spurious nonsafety-ted control signals from adversely affecting safety-related components. If the enable safety switch is active, and no automatic safety actuation or manual actuation signals are sent, the operator is capable of energizing or deenergizing any EIM outputs using the safety-related hardwired control signals. If the enable nonsafety switch is not active, the safety-related hardwired control signals are ignored.
NE Medical Technologies                      7.5-32                                        Rev. 5
 
ESFAS consists of three divisions of input processing and trip determination and two sions of actuation logic (see Figure 7.1-2) arranged so that no single failure within the ESFAS ults in the loss of the protective function.
safety-related inputs into the ESFAS are designed and controlled so they do not prevent the FAS from performing its safety functions. The only nonsafety inputs into the ESFAS are those the PICS for controls and monitoring/indication only variables. The nonsafety control signals the PICS are implemented through a hardwired parallel interface that requires the PICS to d a binary address associated to the output state of the EIM along with a mirrored plement address. The mirrored complement address prevents any single incorrectly sented bit from addressing the wrong EIM output state. To prevent the PICS from vertently presenting a valid address, the ESFAS contains an enable nonsafety switch that trols when the hardwired parallel interface within the APL is active, thus controlling when the S inputs are allowed to pass through the input circuitry and for use in the priority logic within APL. When the enable nonsafety switch is not active, the nonsafety-related control signal is red. If the enable nonsafety is active, and no automatic or manual actuation command is sent, the nonsafety-related control signal can control the ESFAS output. The hardwired dule provides isolation for the nonsafety-related signal path.
following instances exist in the design where the ESFAS only actuates a Division A ponent and a passive check valve is credited as a redundant component:
* A check valve is provided in series with each of the following components to support isolation during a VTS Safety Actuation:
      - MEPS A/B/C extraction column wash supply valve
      - MEPS A/B/C extraction column eluent valve
      - MEPS A/B/C [                            ]PROP/ECI wash supply valve
      - MEPS A/B/C [                            ]PROP/ECI eluent valve
      - IXP recovery column wash supply valve
      - IXP recovery column eluent valve
      - IXP [                        ]PROP/ECI wash supply valve
      - IXP [                        ]PROP/ECI eluent valve
      - IXP FNHS supply valve
      - IXP liquid nitrogen supply valve
* A TPS helium supply check valve is provided in series with the TPS train A/B/C helium supply isolation valve to support isolation during a TPS Train A/B/C Isolation.
* An RLWI PVVS check valve is provided in series with the RLWI PVVS isolation valve to support isolation during an RPF Nitrogen Purge.
ach of the above instances, sufficient redundancy is provided such that no single failure ults in the loss of the protective function.
ESFAS provides separate communication paths to the PICS display systems from each of three ESFAS divisions.
FAS division A is powered from division A of the UPSS. ESFAS division B is powered from sion B of the UPSS. ESFAS division C receives auctioneered power from division A and sion B of the UPSS. The UPSS provides safety-related 125-volt direct current (VDC) and NE Medical Technologies                      7.5-33                                      Rev. 5
 
h division of the ESFAS contains three redundant 125 VDC to 24 VDC converters. The VDC power is distributed to each of three chassis mounting bays, where it is then used to er two redundant 24 VDC to 5 VDC converters located beneath each chassis bay. These vide independent +5-volt (V) A and +5V B power channels to each chassis. This configuration ws for the architecture to handle a single failure of a power supply.
3.4          Operating Conditions ESFAS control and logic functions operate inside of the facility control room where the ironment is mild and not exposed to the irradiation process, and is not subject to operational ing. However, the cables for the ESFAS are routed through the radiologically controlled area he process areas. The routed cables have the potential to be exposed to more harsh ditions than the mild environment of the facility control room. The sensors are located inside process confinement boundary; therefore, the terminations of the cables routed to the sors are exposed to the high radiation environment.
ing normal operation, the ESFAS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, replaced at a frequency sufficient such the radiation qualification of the affected components is not exceeded. The radiation lification of the affected components is based upon the total integrated dose (TID) identified able 7.2-1 being less than the threshold values identified in industry studies.
environmental conditions for ESFAS components are outlined in Table 7.2-1 through le 7.2-3. The facility heating, ventilation and air conditioning (HVAC) systems are relied upon aintain the temperature and humidity parameters in these areas. The facility HVAC systems described in Section 9a2.1.
3.5          Seismic, Tornado, Flood ESFAS equipment is installed in the seismically qualified portion of the main production lity where it is protected from earthquakes, tornadoes, and floods. The ESFAS equipment is smic Category I, tested using biaxial excitation testing and triaxial excitation testing, in ordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.5.3.12).
3.6          Human Factors ESFAS provides manual actuation capabilities for the safety functions identified in section 7.5.3.1, except for the IU Cell Nitrogen Purge signal which originates in the TRPS, the following manual push buttons located on the main control board:
* RCA Isolation
* Supercell Isolation (performs Supercell Areas 1 through 10 Isolations and MEPS A/B/C Heating Loop Isolations)
* VTS Actuation
* TPS Isolation (performs TPS Train A/B/C Isolation and TPS Process Vent Isolation)
* Carbon Delay Bed Group 1 Isolation
* Carbon Delay Bed Group 2 Isolation NE Medical Technologies                      7.5-34                                        Rev. 5
* Extraction Column B Alignment Actuation
* Extraction Column C Alignment Actuation
* IXP Alignment Actuation
* RPF Nitrogen Purge
* Dissolution Tank Isolation support the use of manual actuations, the ESFAS includes isolated outputs for each safety-ted instrument channel to provide monitoring and indication information to the PICS. To litate operator indication of ESFAS actuation function status, manual initiation and reset of ective actions, the ESFAS, at the division level, includes isolated input/output for the wing:
* Indication of ESFAS variable values
* Indication of ESFAS parameter values
* Indication of ESFAS logic status
* Indication of ESFAS equipment status
* Indication of ESFAS actuation device status rator display criteria and design are addressed in Section 7.6.
3.7          Loss of External Power ESFAS is powered from the UPSS, which provides a reliable source of power to maintain ESFAS functional during normal operation and during and following a design basis event.
UPSS is designed to provide power to the ESFAS controls for six hours after a loss of off-power. The UPSS is described in Section 8a2.2.
trolled components associated with safety actuations are designed to go to their safe state n deenergized. On a loss of power to the ESFAS, the ESFAS deenergizes actuation ponents to the positions defined in Table 7.5-2.
FAS response to a loss of external power signal is discussed in Subsection 7.5.4.1.19.
3.8          Fire Protection ESFAS design utilizes physical separation to minimize the effects from fire or explosion.
ety-related ESFAS equipment in different divisions is located in separate fire areas when ctical. Exceptions include components for all three divisions located in the facility control room in other locations where end devices are installed.
sical separation is used to achieve separation of redundant sensors. Wiring for redundant sions uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each of Division A, Division B, Division C. Division A and C cables are routed along the south side of the RPF to the facility trol room and Division B cables are routed on the north side of the RPF. Where possible, duit is routed subgrade to provide additional separation. Instrument transmitters are located eparate areas: A and C instrumentation is located primarily on the east side of the G-line wall, e Division B is located along the west side of the wall.
NE Medical Technologies                    7.5-35                                          Rev. 5
 
ss A and Class C fire extinguishers are located in the control room to extinguish fires inating within a cabinet, console, or connecting cables. Wet sprinklers are not used in the lity control room to avoid potentially impairing the ability of the ESFAS to perform its safety tions.
combustible and heat resistant materials are used whenever practical in the ESFAS design, icularly in locations such as confinement boundaries and the facility control room. Use of erials that release toxic or corrosive gases under combustion is minimized.
safety-related ESFAS inputs and outputs are routed in non-divisional cable raceways and segregated from safety-related inputs and outputs. Spatial separation between cable and eway groups is in accordance with Section 5.1.1.2, Table 1 of Section 5.1.3.3, and Table 2 of tion 5.1.4 of IEEE Standard 384-2008 (IEEE, 2008) (Subsection 7.5.3.12).
3.9          Classification and Identification h ESFAS cable and component is uniquely identified in accordance with the SHINE ponent numbering guideline. The unique identification number includes, but is not limited to, tem designation (code), equipment train, and division.
3.10        Setpoints servative setpoints for the ESFAS monitored variables are established based on umented analysis methodology (Subsection 7.2.1). Setpoint analysis parameters typically sider instrument precision, sensitivity, accuracy, loop uncertainties, and computational errors.
quate margin is required between the setpoints and the associated safety limits to ensure the ective action is initiated prior to the safety limit being exceeded. The setpoint values are ved from approved system design technical reports, design calculations, uncertainty ulations, and technical specifications.
log signals are input into the input sub-module (ISM) of an SFM. The ISM consists of a signal ditioning circuit, analog to digital converter, and a serial interface to the SFM FPGA. The ISM verts the process analog input signal to a raw value in digital format, which is provided to the M where it is compared with a setpoint in raw value.
3.11        Prioritization of Functions APL (which is constructed of discrete components and part of the equipment interface dule) is designed to provide priority to safety-related signals over nonsafety-related signals.
sion A and Division B priority logic of the ESFAS prioritizes the following ESFAS inputs, with first input listed having the highest priority and each successive input in the list having a lower rity than the previous:
(1) Automatic Safety Actuation, Manual Safety Actuation (2) PICS nonsafety control signals manual actuation inputs from the operators in the facility control room are connected directly he discrete APL. The manual actuation input into the priority logic does not have the ability to NE Medical Technologies                      7.5-36                                        Rev. 5
 
omatic or manual safety actuations over the PICS control signals.
3.12        Design Codes and Standards following codes and standards are applied to the ESFAS design.
: 1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet ESFAS Criterion 14.
: 2) IEEE Standard 379-2000, IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating Station Safety Systems (IEEE, 2000); invoked as guidance to meet SHINE Design Criterion 15.
: 3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked as guidance for separation of safety-related and nonsafety-related cables and raceways to meet ESFAS Design Criteria 21 and 22, and as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.
: 4) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to meet ESFAS Design Criterion 47 and to support electromagnetic compatibility qualification for digital I&C equipment.
: 5) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).
: 6) IEEE Standard 1012-2004, IEEE Standard for Software Verification and Validation (IEEE 2004a); invoked as guidance to meet ESFAS Design Criterion 8.
: 7) IEEE Standard 323-2003, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations (IEEE, 2003b), invoked as guidance to meet ESFAS Criterion 14.
4        OPERATION AND PERFORMANCE section 7.5.4 discusses the operation of the ESFAS.
ESFAS design basis functions utilize redundant logic to ensure safe and reliable operation to prevent a single failure from defeating the intended function. Additional information related he effects of single failure, reliability, redundancy, and independence can be found in section 7.5.2.
4.1          Monitored Variables and Response le 7.5-1 identifies specific variables that provide input into the ESFAS and includes the rument range for covering normal and accident conditions, the accuracy for each variable, the lytical limit, and response time. A discussion of each variable (signal input) and the system ponse is provided in this section.
NE Medical Technologies                      7.5-37                                      Rev. 5
 
high RVZ1 and RVZ2 RCA exhaust radiation signals protect against confinement leakage or idents that could potentially result in excess radiation doses to the workers or to the public bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16). A signal is generated by ESFAS when RVZ1 or RVZ2 RCA exhaust radiation input exceeds its high level setpoint. RVZ1 and RVZ2 A exhaust radiation is measured using an analog interface on three different channels in Z1 and three different channels in RVZ2, one channel of each type for each division of FAS. When two-out-of-three or more high RVZ1 or two-out-of-three or more RVZ2 RCA aust radiation channels exceed their setpoint, then an RCA Isolation is initiated.
4.1.2      High RVZ1 Supercell Exhaust Ventilation Radiation (PVVS Hot Cell) high RVZ1 supercell area 1 (PVVS) exhaust ventilation radiation signal protects against hot equipment leakage or an accident that could potentially result in excess radiation doses to workers or to the public. The signal is used to indicate potential radioactivity releases in the VS hot cell similar to those described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3). The signal is generated by ESFAS when an RVZ1 supercell a 1 (PVVS) exhaust ventilation radiation input exceeds the high level setpoint. RVZ1 supercell a 1 (PVVS) exhaust ventilation radiation is measured using an analog interface on three rent channels, one for each division of ESFAS. When two-out-of-three or more RVZ1 ercell area 1 (PVVS) exhaust ventilation radiation channels exceed their setpoint, then a ercell Isolation for area 1 and a VTS Safety Actuation are initiated.
4.1.3      High RVZ1 Supercell Exhaust Ventilation Radiation (MEPS Extraction Hot Cells) high RVZ1 supercell area 2/6/7 (extraction A/B/C) exhaust ventilation radiation signals ect against hot cell equipment leakage or an accident that could potentially result in excess ation doses to the workers or to the public (Subsection 13b.1.2.3, Scenarios 1, 2, 3, and 13) heir respective hot cells. A signal is generated by ESFAS when an RVZ1 supercell area 2/6/7 raction A/B/C) exhaust ventilation radiation input exceeds its high level setpoint. RVZ1 ercell area 2/6/7 (extraction A/B/C) exhaust ventilation radiation is measured using an analog rface on two different channels per area, one for each Division A and Division B of ESFAS.
en one-out-of-two or more RVZ1 supercell area 2/6/7 (extraction A/B/C) exhaust ventilation ation channels exceed their setpoint (for a single area), then a Supercell Isolation for that a, MEPS Heating Loop Isolation, and VTS Safety Actuation are initiated.
4.1.4      High RVZ1 Supercell Exhaust Ventilation Radiation (IXP Hot Cell) high RVZ1 supercell area 10 (IXP) exhaust ventilation radiation signal protects against hot equipment leakage or an accident that could potentially result in excess radiation doses to workers or to the public (Subsection 13b.1.2.3, Scenarios 4, 5, 6, and 7). The signal is erated by ESFAS when an RVZ1 supercell area 10 (IXP) exhaust ventilation radiation input eeds the high level setpoint. RVZ1 supercell area 10 (IXP) exhaust ventilation radiation is asured using an analog interface on two different channels, one for each Division A and sion B of ESFAS. When one-out-of-two or more RVZ1 supercell area 10 (IXP) exhaust tilation radiation channels exceed their setpoint, then a Supercell Isolation for area 10 and a Safety Actuation are initiated.
NE Medical Technologies                    7.5-38                                        Rev. 5
 
high RVZ1 supercell area 3/4/5/8/9 (purification A/B/C and packaging 1/2) exhaust tilation radiation signals protect against hot cell equipment leakage or an accident that could entially result in excess radiation doses to the workers or to the public for their respective hot
: s. The signals are used to indicate potential radioactivity releases in the purification or kaging cells similar to those described in Chapter 13 for RPF critical equipment malfunction nts (Subsection 13b.1.2.3). A signal is generated by ESFAS when an RVZ1 supercell a 3/4/5/8/9 (purification A/B/C or packaging 1/2) exhaust ventilation radiation input exceeds igh level setpoint. RVZ1 supercell area 3/4/5/8/9 (purification A/B/C and packaging 1/2) aust ventilation radiation is measured using an analog interface on two different channels per a, one for each Division A and Division B of ESFAS. When one-out-of-two or more RVZ1 ercell area 3/4/5/8/9 (purification A/B/C and packaging 1/2) exhaust ventilation radiation nnels exceed their setpoint (for a single area), then a Supercell Isolation for that area is ated.
4.1.6        High MEPS Heating Loop Radiation high MEPS heating loop radiation extraction area A/B/C signals protect against leakage of radiation solutions into the heating water loop, which is partially located outside the ercell shielding and could potentially result in an excess dose to the workers bsection 13b.1.2.3, Scenario 14). The signal is generated by ESFAS when a MEPS heating radiation extraction area A/B/C input exceeds the high level setpoint. The MEPS heating radiation extraction area A/B/C is measured on two different channels, one for each sion A and Division B of ESFAS. MEPS heating loop radiation is measured in three locations PS extraction hot cells A, B, and C). When one-out-of-two or more MEPS heating loop ation extraction area A/B/C channels exceed their setpoint in a given heating loop (A, B,
  ), then a MEPS Heating Loop Isolation is initiated for that heating loop.
4.1.7        High PVVS Carbon Delay Bed Exhaust Carbon Monoxide high PVVS carbon delay bed group 1/2/3 exhaust carbon monoxide signals protect against a in the PVVS delay bed (Subsection 13b.1.2.5, Scenario 1). The signal is generated by FAS for the associated carbon delay bed group (Group 1, 2, or 3) when a carbon delay bed up 1/2/3 exhaust carbon monoxide input exceeds the high level setpoint. The PVVS carbon y bed group 1/2/3 exhaust carbon monoxide is measured with an analog interface on two rent channels, one for each Division A and Division B of ESFAS. When one-out-of-two or e PVVS carbon delay bed group 1/2/3 exhaust carbon monoxide channels exceed their oint, then a Carbon Delay Bed Isolation for the affected group is initiated.
4.1.8        VTS Vacuum Header Liquid Detection VTS vacuum header liquid detection signal protects against an overflow of the vacuum lift s to prevent a potential criticality event as described in Subsection 6b.3.2.5. The VTS uum header liquid detection signal is received by the ESFAS as a discrete input from a liquid ection switch on two different channels, one for each Division A and Division B of ESFAS.
en one-out-of-two or more (Division A and Division B) VTS vacuum header liquid detection nnels indicate liquid is detected, then a VTS Safety Actuation is initiated.
NE Medical Technologies                      7.5-39                                        Rev. 5
 
RDS liquid detection signal detects leakage or overflow from other tanks and piping bsection 13b.1.2.3, Scenarios 8, 10, 11, 12, and 16). The RDS liquid detection signal is eived by the ESFAS as a discrete input from a liquid detection switch on two different nnels, one for each Division A and Division B of ESFAS. When one-out-of-two or more RDS id detection channels indicate liquid is detected, then a VTS Safety Actuation is initiated.
4.1.10      High TPS IU Cell 1/2/3/4/5/6/7/8 Target Chamber Exhaust Pressure high TPS IU Cell 1/2/3/4/5/6/7/8 target chamber exhaust pressure signal protects against a ak in the tritium exhaust lines in the IU cell (Subsection 13a2.1.6.2, Scenario 3 and section 13a2.1.12.2, TPS Scenario 3). The signal is generated by ESFAS when a target mber exhaust pressure input exceeds the high level setpoint. The TPS IU Cell 1/2/3/4/5/6/7/8 et chamber exhaust pressure is measured with an analog interface on two different channels, for each Division A and Division B of ESFAS. When one-out-of-two or more TPS IU 1/2/3/4/5/6/7/8 target chamber exhaust pressure inputs exceed the allowable limit, the ropriate TPS Train A/B/C Isolation is initiated.
4.1.11      High TPS IU Cell 1/2/3/4/5/6/7/8 Target Chamber Supply Pressure high TPS IU Cell 1/2/3/4/5/6/7/8 target chamber supply pressure signal protects against a ak in the tritium supply lines in the IU cell (Subsection 13a2.1.6.2, Scenario 3 and section 13a2.1.12.2, TPS Scenario 3). The signal is generated by ESFAS when a target mber supply pressure input exceeds the high level setpoint. The TPS IU Cell 1/2/3/4/5/6/7/8 et chamber supply pressure is measured with an analog interface on two different channels, for each Division A and Division B of ESFAS. When one-out-of-two or more TPS IU 1/2/3/4/5/6/7/8 target chamber supply pressure inputs exceed the allowable limit, the ropriate TPS Train A/B/C Isolation is initiated.
4.1.12      High TPS Exhaust to Facility Stack Tritium high TPS exhaust to facility stack tritium signal protects against a release of tritium from the glovebox pressure control exhaust and VAC/ITS process vent exhaust into the facility tilation systems (Subsection 13a2.1.12.2, TPS Scenario 3 and TPS Scenario 4). The signal is erated by ESFAS when a TPS exhaust to facility stack tritium input exceeds the high level oint. The TPS exhaust to facility stack tritium is measured with an analog interface on three rent channels, one for each division of ESFAS. When two-out-of-three or more TPS exhaust acility stack tritium channels exceed their setpoint, then a TPS Process Vent Actuation is ated.
4.1.13      High TPS Confinement Tritium high TPS confinement A/B/C tritium signals protect against a release of tritium from TPS ipment into the associated TPS glovebox (Subsection 13a2.1.12.2, TPS Scenario 1). A al is generated by ESFAS when a TPS confinement A/B/C tritium input exceeds its high level oint. There is an independent and separate tritium measurement for each of the three TPS ns. TPS confinement tritium concentration is measured using an analog interface on two rent channels per glovebox, one for each Division A and Division B of ESFAS. When one-of-two or more TPS confinement A/B/C tritium channels exceed their setpoint (for a particular NE Medical Technologies                      7.5-40                                        Rev. 5
 
4.1.14      TRPS IU Cell 1/2/3/4/5/6/7/8 Nitrogen Purge TRPS IU cell 1/2/3/4/5/6/7/8 nitrogen purge signal protects against a loss of hydrogen gation capabilities in the irradiation units (Subsection 13a2.1.2.2, Scenario 5 and section 13a2.1.9.2, Scenario 1). The signal is generated by an affected TRPS subsystem provided to the ESFAS when the TRPS initiates an IU Cell Nitrogen Purge, as described in section 7.4.3.1.2. The TRPS IU cell 1/2/3/4/5/6/7/8 nitrogen purge signal is transmitted as a rete input from the TRPS on two different channels, one for each Division A and Division B of FAS. When a TRPS IU cell 1/2/3/4/5/6/7/8 nitrogen purge indicates purging, then an ESFAS Cell Nitrogen Purge is initiated.
4.1.15      Low PVVS Flow PVVS flow signal protects against loss of hydrogen mitigation capabilities in the RPF bsection 13a2.1.6.2, Scenario 7). The signal is generated by ESFAS when a PVVS flow input eeds the low level setpoint. The PVVS flow is measured with an analog interface on three rent channels, one for each division of ESFAS. When two-out-of-three or more PVVS flow nnels exceed their setpoint, then an RPF Nitrogen Purge is initiated.
4.1.16      MEPS Area A/B/C Three-Way Valve Position Indication MEPS area A/B/C three-way valve position indication signals protect against a misalignment he extraction column upper and lower three-way valves, degrading one of the barriers venting misdirection of chemical reagents or target solution (Subsection 13b.1.2.3, nario 15). The MEPS extraction column upper and lower three-way valve position indication ceived by the ESFAS as a discrete input from redundant position indicating limit switches on different channels, one for each Division A and Division B of ESFAS, for each three-way
: e. When two-out-of-two MEPS area A/B/C extraction column upper and lower three-way e position indications indicate they are in the supplying position (i.e., energized), then an action Column Alignment Actuation for that area is initiated.
4.1.17      IXP Three-Way Valve Position Indication IXP three-way valve position indication signals protect against a misalignment of the upper lower three-way valves, degrading one of the barriers preventing misdirection of chemical gents or target solution. The signal is used to detect scenarios similar to a MEPS extraction mn three-way valve misalignment as described in Subsection 13b.1.2.3, Scenario 15. The three-way valve position indication is received by the ESFAS as a discrete input from undant position indicating limit switches on two different channels, one for each Division A Division B of ESFAS, for each three-way valve. When two-out-of-two IXP three-way valve ition indications indicate they are in the supplying position (i.e., energized), then an IXP nment Actuation is initiated.
4.1.18      TSPS Dissolution Tank 1/2 Level TSPS dissolution tank 1/2 level signals protect against a criticality event due to excess fissile erial in a non-favorable geometry system (Subsection 6b.3.2.4). The TSPS dissolution NE Medical Technologies                      7.5-41                                        Rev. 5
 
e TSPS dissolution tank 1/2 level signals indicate high level for either dissolution tank, a solution Tank Isolation is initiated.
4.1.19      UPSS Loss of External Power UPSS loss of external power signal protects against an anticipatory loss of hydrogen gation in the IU cell (i.e., loss of TSV off-gas system [TOGS] blowers and recombiners after UPSS runtime of that equipment has been exceeded), as described in section 13a2.1.9.2, Scenario 1. The UPSS loss of external power signal is received by the FAS as a discrete input signal on two different channels, one for each Division A and sion B of ESFAS. When one-out-of-two or more UPSS loss of external power signals indicate s of power, a timer is started that must run to completion before initiating an IU Cell Nitrogen ge. While the timer is running, if fewer than one-out-of-two UPSS loss of external power als indicate loss of power, the timer is reset and the ESFAS continues operating under mal conditions. The timer is set at three minutes to provide margin to the loss of TOGS ipment after five minutes of runtime on the UPSS. The ESFAS initiated IU Cell Nitrogen ge signal is provided to each of the eight TRPS subsystems as an ESFAS loss of external er signal as described in Subsection 7.4.4.1.14.
4.2          Operational Bypass, Permissives, and Interlocks ESFAS has no operational bypasses included in the design, and therefore no interlocks are uired to prevent operator actions from defeating an automatic safety function.
r an ESFAS actuation, the ESFAS system must receive feedback signals from each acted actuated device that each device has indeed reached its fail-safe position. Only then the operator, through deliberate action with the manual enable nonsafety switch, be allowed nable the PICS to reset the components.
4.3          Facility Master Operating Permissive ESFAS incorporates the facility master operating permissive key switch in the system ign. The key switch has two positions, Operating and Secure (Subsection 7.6.1.1). When the lity master operating permissive key switch is active (operating), the ESFAS operates in the mal, nonsecure mode. When the facility master operating permissive key switch is placed in Secure position or removed from the main control board, the actuations and Mode transitions trolled by the key switch cannot be reset until the key has been inserted and returned to the rate position.
key switch engages divisions A and B of the ESFAS and is then transmitted to each of the t instances of the TRPS when the key is inserted and is in the Operate position. Disengaging facility master operating permissive switch, which occurs when the key is in the Secure ition or is removed, initiates select TRPS and ESFAS functions (Subsections 7.4.3.1, 4.1.18, and 7.5.3.1) and initiates Mode transitions as described in Subsection 7.4.3.2.
NE Medical Technologies                      7.5-42                                        Rev. 5
 
h SFM can be placed in maintenance bypass or in a trip state by use of the OOS switch ted on the front of the SFM and an associated trip/bypass switch located below the SFM.
ails of the physical configuration and operation of the OOS and trip/bypass switches are vided in Sections 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). Any FAS channels placed in maintenance bypass for maintenance or testing, or removed from ntenance bypass, will be displayed to the operators in the facility control room through the nitoring and indication bus to the PICS.
ndividual SFM within an ESFAS division is allowed to be placed in maintenance bypass for o two hours while the associated input channel(s) is required to be operable, in accordance the technical specifications, for the purpose of performing required technical specification veillance testing. A time limit of two hours is acceptable based on the small amount of time the nnel could be in bypass, the continual attendance by operations or maintenance personnel ng the test, the continued operability of the redundant channel(s), and the low likelihood that accident would occur during the two-hour time period.
SFM may also be placed in trip by use of the OOS and trip/bypass switches, as described in tions 2.5.1 and 2.5.2 of Topical Report TR-1015-18653 (NuScale, 2017). With the OOS ch in the OOS position, the trip/bypass switch is used to activate maintenance trips and ntenance bypasses. The trip/bypass switch signal is input first to a hardwired module (HWM),
ch then converts the trip/bypass discrete input to a logic level signal and makes the signal ilable to the associated SBMs or SBVMs within the same division as the trip/bypass switch.
en the OOS switch is in the Operate position and the SFM is functioning normally, the SBMs BVMs associated with the SFM will ignore the associated trip/bypass switch input.
SFMs continually provide the status of their OOS switch to the associated divisional SBMs or VMs along with their partial trip information. With an SFMs OOS switch in the OOS position the associated trip/bypass switch in the trip position, the associated divisional SBMs or VMs will then assert all partial trip information associated with the SFM to the trip state for t to coincident logic voting in the SBVMs. All of the partial trip information associated with all ts for this SFM would be in a maintenance trip condition for this case. For those safety tions that use two-out-of-three coincident voting, a single failure of the same SFM in another sion would not defeat the safety function because the third remaining divisional SFM is ilable to complete a two-out-of-three vote if required. For those safety functions that only use
-out-of-two coincident voting, the safety functions would be actuated when the OOS switch is ed into the OOS position with the associated trip/bypass switch in the trip position.
h an SFMs OOS switch in the OOS position and the associated trip/bypass switch in the ass position, the associated divisional SBMs or SBVMs will then assert all partial trip rmation associated with the SFM to the bypassed state (not tripped) for input to coincident c voting in the SBVMs. All of the partial trip information associated with all inputs for this SFM ld be in a maintenance bypass condition for this case. For safety functions that use either
-out-of-two or two-out-of-three coincident voting, a single failure of the same SFM in another sion would defeat the safety function. Placing a single SFM in maintenance bypass is allowed he technical specifications for up to two hours for the purpose of performing required nical specification surveillance testing.
NE Medical Technologies                      7.5-43                                        Rev. 5
 
4.5          Testing Capability ting of the ESFAS consists of the inservice self-testing capabilities of the HIPS platform and odic surveillance testing.
-to-end testing of the entire HIPS platform can be performed through overlap testing.
vidual self-tests in the various components of the ESFAS ensure that the entire component is tioning correctly. Self-test features are provided for components that do not have setpoints or able parameters. ESFAS components, except the discrete APL of the EIM, have self-testing abilities that ensure the information passed on to the following step in the signal path is ect.
discrete logic of the APL of the EIM does not have self-test capability but is instead tionally tested. This functional testing consists of periodic simulated automatic and manual ations to verify the functionality of the APL and the manual actuation pushbuttons.
ting of input devices consists of channel checks, channel tests, and channel calibrations.
nnel checks are performed while the channel is in service. Channel tests and channel brations may be performed while the associated equipment is in a condition where the nnel is required to be operable (i.e., inservice), by placing the associated SFM in ntenance bypass (Subsection 7.5.4.4). Channel tests and channel calibrations may also be ormed when the channel is not required to be operable.
4.6          Technical Specifications and Surveillance iting conditions for operation and surveillance requirements are established for ESFAS logic, ng, and actuation divisions and instrumentation monitored by ESFAS as input to safety ations. Limiting conditions for operation are established for components of the safety-related systems that perform safety functions to ensure that the system will remain available to orm safety functions when required. Surveillance requirements are performed at a frequency nsure that limiting safety system settings (Subsection 7.2.1) are not exceeded.
5        HIGHLY INTEGRATED PROTECTION SYSTEM (HIPS) DESIGN ESFAS utilizes a HIPS platform to achieve the desired architecture for ESFAS system trol. The HIPS platform used to support both the TRPS and the ESFAS is described in section 7.4.5. The HIPS design described in Subsection 7.4.5 addresses HIPS design butes, access control and cyber security, software development requirements, and HIPS ormance analysis.
ESFAS HIPS architecture is shown in Figure 7.1-3.
6        CONCLUSION safety-related ESFAS is designed to specific and measurable criteria to ensure quality and quacy in the system design, implementation, and maintenance.
NE Medical Technologies                      7.5-44                                      Rev. 5
 
HIPS platform used in the ESFAS design is based on fundamental instrumentation and trol principles of independence, redundancy, predictability and repeatability, and diversity and developed under quality management to provide a simple yet reliable solution for the safety-ted ESFAS functions.
NE Medical Technologies                  7.5-45                                          Rev. 5
 
Table 7.5 ESFAS Monitored Variables (Sheet 1 of 6)
Variable                  Analytical Limit        Logic          Range        Accuracy  Response Time RVZ1 RCA exhaust radiation        15x background radiation      2/3    10-7 to 10-1 µCi/cc 20 percent  15 seconds RVZ2 RCA exhaust radiation        15x background radiation      2/3    10-7 to 10-1 µCi/cc 20 percent  15 seconds RVZ1 supercell area 1 (PVVS) 15x background radiation      2/3    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation Z1 supercell area 2 (extraction A) 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation RVZ1 supercell area 3 urification A) exhaust ventilation 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds radiation Z1 supercell area 4 (packaging 1) 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation RVZ1 supercell area 5 urification B) exhaust ventilation 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds radiation Z1 supercell area 6 (extraction B) 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation Z1 supercell area 7 (extraction C) 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation RVZ1 supercell area 8 urification C) exhaust ventilation 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds radiation Z1 supercell area 9 (packaging 2) 15x background radiation      1/2    10-7 to 10-1 µCi/cc 20 percent  15 seconds exhaust ventilation radiation NE Medical Technologies                                      7.5-46                                                Rev. 5
 
Variable              Analytical Limit      Logic          Range          Accuracy    Response Time RVZ1 supercell area 10 (IXP) 15x background radiation    1/2  10-7 to 10-1 µCi/cc  20 percent    15 seconds exhaust ventilation radiation MEPS heating loop radiation 2500 mR/hr          1/2  0.1 to 10,000 mR/hr    20 percent    5 seconds extraction area A MEPS heating loop radiation 2500 mR/hr          1/2  0.1 to 10,000 mR/hr    20 percent    5 seconds extraction area B MEPS heating loop radiation 2500 mR/hr          1/2  0.1 to 10,000 mR/hr    20 percent    5 seconds extraction area C PVVS carbon delay bed group 1 50 ppm            1/2      1 to 100 ppm      10 percent    15 seconds exhaust carbon monoxide PVVS carbon delay bed group 2 50 ppm            1/2      1 to 100 ppm      10 percent    15 seconds exhaust carbon monoxide PVVS carbon delay bed group 3 50 ppm            1/2      1 to 100 ppm      10 percent    15 seconds exhaust carbon monoxide VTS vacuum header                                          Liquid detected/liquid  Discrete Liquid detected        1/2                                      5.5 seconds liquid detection                                              not detected      input signal Liquid detected/liquid  Discrete RDS liquid detection            Liquid detected        1/2                                      5.5 seconds not detected      input signal TPS exhaust to 1 Ci/m3            2/3 1 to 2,000,000 µCi/m3  10 percent    5 seconds facility stack tritium TPS IU cell 1 target chamber 8 psia            1/2      0 to 19.5 psia      1 percent    10 seconds exhaust pressure TPS IU cell 2 target chamber 8 psia            1/2      0 to 19.5 psia      1 percent    10 seconds exhaust pressure NE Medical Technologies                                7.5-47                                                Rev. 5
 
Variable              Analytical Limit  Logic    Range      Accuracy  Response Time TPS IU cell 3 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure TPS IU cell 4 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure TPS IU cell 5 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure TPS IU cell 6 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure TPS IU cell 7 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure TPS IU cell 8 target chamber 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds exhaust pressure S IU cell 1 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure S IU cell 2 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure S IU cell 3 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure S IU cell 4 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure S IU cell 5 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure S IU cell 6 target chamber supply 8 psia          1/2 0 to 19.5 psia 1 percent  10 seconds pressure NE Medical Technologies                            7.5-48                                      Rev. 5
 
Variable              Analytical Limit  Logic      Range          Accuracy    Response Time S IU cell 7 target chamber supply 8 psia        1/2  0 to 19.5 psia      1 percent    10 seconds pressure S IU cell 8 target chamber supply 8 psia        1/2  0 to 19.5 psia      1 percent    10 seconds pressure TPS confinement A tritium        1000 Ci/m3        1/2  1 to 1,000 Ci/m3    10 percent    5 seconds TPS confinement B tritium        1000 Ci/m3        1/2  1 to 1,000 Ci/m3    10 percent    5 seconds TPS confinement C tritium        1000 Ci/m3        1/2  1 to 1,000 Ci/m3    10 percent    5 seconds PVVS flow                5.0 scfm        2/3      1-20 scfm        3 percent  0.5 seconds High level/not high  Discrete TSPS dissolution tank 1 level        High level      1/2                                    1 second level      input signal High level/not high  Discrete TSPS dissolution tank 2 level        High level      1/2                                    1 second level      input signal TRPS IU cell 1                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal TRPS IU cell 2                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal TRPS IU cell 3                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal TRPS IU cell 4                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal TRPS IU cell 5                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal TRPS IU cell 6                                                          Discrete Purging        1/1 Purging/not purging                  500 ms nitrogen purge                                                        input signal NE Medical Technologies                            7.5-49                                              Rev. 5
 
Variable        Analytical Limit    Logic          Range          Accuracy    Response Time TRPS IU cell 7                                                        Discrete Purging          1/1    Purging/not purging                  500 ms nitrogen purge                                                      input signal TRPS IU cell 8                                                        Discrete Purging          1/1    Purging/not purging                  500 ms nitrogen purge                                                      input signal MEPS area A lower Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
MEPS area A upper Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
MEPS area B lower Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
MEPS area B upper Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
MEPS area C lower Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
MEPS area C upper Supplying/not      Discrete three-way valve        Supplying      1/2 & 1/2                                    1 second supplying      input signal position indication(a)
NE Medical Technologies                    7.5-50                                                  Rev. 5
 
Variable                      Analytical Limit            Logic            Range              Accuracy      Response Time IXP lower three-way valve                                                          Supplying/not          Discrete Supplying            1/2 & 1/2                                                1 second position indication(a)                                                          supplying          input signal IXP upper three-way valve                                                          Supplying/not          Discrete Supplying            1/2 & 1/2                                                1 second position indication(a)                                                          supplying          input signal Discrete UPSS loss of external power                Loss of power              1/2      Power/loss of power                          1 second input signal A safety actuation is initiated when both the lower and upper three-way valves show one-out-of-two of the redundant position indications are in the supplying position.
NE Medical Technologies                                            7.5-51                                                              Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                          Engineered Safety Features Actuation System Table 7.5 Fail Safe Component Positions on ESFAS Loss of Power (Sheet 1 of 2)
FAIL-SAFE POSITION: CLOSED RVZ1 RCA exhaust isolation dampers                                      RVZ2 supercell area 9 (packaging area 2) inlet isolation dampers RVZ2 RCA exhaust isolation dampers                                      RVZ1 supercell area 9 (packaging area 2) outlet isolation dampers RVZ2 RCA supply isolation dampers                                        RVZ2 supercell area 10 (IXP area) inlet isolation dampers RVZ2 main RCA ingress/egress supply isolation dampers                    RVZ1 supercell area 10 (IXP area) outlet isolation dampers RVZ2 main RCA ingress/egress exhaust isolation dampers                  RVZ2 TPS room supply isolation dampers RVZ3 transfer isolation dampers shipping/receiving IF                    RVZ2 TP S room exhaust isolation dampers RVZ3 transfer isolation dampers shipping/receiving RPF                  RLWI PVVS isolation valve RVZ3 transfer isolation dampers RPF emergency exit                      MEPS heating loop A inlet isolation valve RVZ3 transfer isolation dampers IF emergency exit                        MEPS heating loop B inlet isolation valve RVZ3 transfer isolation dampers mezzanine emergency exit                MEPS heating loop C inlet isolation valve TSPS air inlet isolative valve                                          MEPS heating loop A discharge isolation valve TSPS RVZ1 exhaust valve                                                  MEPS heating loop B discharge isolation valve RVZ2 supercell area 1 (PVVS area) inlet isolation dampers                MEPS heating loop C discharge isolation valve RVZ1 supercell area 1 (PVVS area) outlet isolation dampers              MEPS A extraction column wash supply valve RVZ2 supercell area 2 (extraction area A) inlet isolation dampers        MEPS A extraction column eluent valve RVZ1 supercell area 2 (extraction area A) outlet isolation dampers      MEPS A [                        ]PROP/ECI wash supply valve RVZ2 supercell area 3 (purification area A) inlet isolation dampers      MEPS A [                        ]PROP/ECI eluent valve RVZ1 supercell area 3 (purification area A) outlet isolation dampers    MEPS B extraction column wash supply valve RVZ2 supercell area 4 (packaging area 1) inlet isolation dampers        MEPS B extraction column eluent valve RVZ1 supercell area 4 (packaging area 1) outlet isolation dampers        MEPS B [                        ]PROP/ECI wash supply valve RVZ2 supercell area 5 (purification area B) inlet isolation dampers      MEPS B [                        ]PROP/ECI eluent valve RVZ1 supercell area 5 (purification area B) outlet isolation dampers    MEPS C extraction column wash supply valve RVZ2 supercell area 6 (extraction area B) inlet isolation dampers        MEPS C extraction column eluent valve RVZ1 supercell area 6 (extraction area B) outlet isolation dampers      MEPS C [                        ]PROP/ECI wash supply valve RVZ2 supercell area 7 (extraction area C) inlet isolation dampers        MEPS C [                        ]PROP/ECI eluent valve RVZ1 supercell area 7 (extraction area C) outlet isolation dampers      IXP recovery column wash supply valve RVZ2 supercell area 8 (purification area C) inlet isolation dampers      IXP recovery column eluent valve RVZ1 supercell area 8 (purification area C) outlet isolation dampers    IXP [                  ]PROP/ECI wash supply valve RVZ1 supercell area 8 (purification area C) outlet isolation dampers    IXP [                  ]PROP/ECI eluent valve SHINE Medical Technologies                                          7.5-52                                                          Rev. 5
 
FNHS supply valve                                                TPS train B vacuum isolation valves liquid nitrogen supply valve                                    TPS train C glovebox pressure control exhaust isolation valves S train A glovebox pressure control exhaust isolation valves      TPS train C ITS isolation valves S train A ITS isolation valves                                    TPS train C helium supply isolation valve S train A helium supply isolation valve                            TPS train C vacuum isolation valves S train A vacuum isolation valves                                  N2PS PVVS north header valves S train B glovebox pressure control exhaust isolation valves      N2PS PVVS south header valves S train B ITS isolation valves                                    TSPS RPCS supply cooling valves S train B helium supply isolation valve                            TSPS RPCS return cooling valve FAIL-SAFE POSITION: OPEN Z1 exhaust train 1 blower breakers                                PVVS blower bypass valves Z1 exhaust train 2 blower breakers                                PVVS carbon guard bed bypass valves Z2 exhaust train 1 blower breakers                                PVVS carbon delay bed group 1 outlet isolation valves Z2 exhaust train 2 blower breakers                                PVVS carbon delay bed group 2 outlet isolation valves Z2 supply train 1 blower breakers                                  PVVS carbon delay bed group 3 outlet isolation valves Z2 supply train 2 blower breakers                                  MEPS A extraction feed pump breakers S vacuum transfer pump 1 breakers                                  MEPS B extraction feed pump breakers S vacuum transfer pump 2 breakers                                  MEPS C extraction feed pump breakers S vacuum break valves                                              N2PS IU cell header valves N2PS RPF header valves FAIL-SAFE POSITION: SUPPLYING VS carbon delay bed group 1 three-way valves VS carbon delay bed group 2 three-way valves VS carbon delay bed group 3 three-way valves FAIL-SAFE POSITION: DISCHARGING PS area A lower three-way valve                                    MEPS area C lower three-way isolation valve PS area A upper three-way valve                                    MEPS area C upper three-way isolation valve PS area B lower three-way valve                                    IXP upper three-way valve PS area B upper three-way valve                                    IXP lower three-way valve NE Medical Technologies                                      7.5-53                                                          Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 1 of 27)
SHINE Medical Technologies                                    7.5-54                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 2 of 27)
SHINE Medical Technologies                                    7.5-55                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 3 of 27)
SHINE Medical Technologies                                    7.5-56                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 4 of 27)
SHINE Medical Technologies                                    7.5-57                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 5 of 27)
SHINE Medical Technologies                                    7.5-58                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 6 of 27)
SHINE Medical Technologies                                    7.5-59                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 7 of 27)
SHINE Medical Technologies                                    7.5-60                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 8 of 27)
SHINE Medical Technologies                                    7.5-61                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 9 of 27)
SHINE Medical Technologies                                    7.5-62                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 10 of 27)
SHINE Medical Technologies                                    7.5-63                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 11 of 27)
SHINE Medical Technologies                                    7.5-64                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 12 of 27)
SHINE Medical Technologies                  7.5-65                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 13 of 27)
SHINE Medical Technologies                                    7.5-66                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 14 of 27)
SHINE Medical Technologies                                    7.5-67                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 15 of 27)
SHINE Medical Technologies                                    7.5-68                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 16 of 27)
SHINE Medical Technologies                                    7.5-69                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 17 of 27)
SHINE Medical Technologies                  7.5-70                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 18 of 27)
SHINE Medical Technologies                  7.5-71                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 19 of 27)
SHINE Medical Technologies                                    7.5-72                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 20 of 27)
SHINE Medical Technologies                  7.5-73                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 21 of 27)
SHINE Medical Technologies                                    7.5-74                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 22 of 27)
SHINE Medical Technologies                                    7.5-75                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Chapter 7 - Instrumentation and Control Systems                                      Engineered Safety Features Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 23 of 27)
SHINE Medical Technologies                                    7.5-76                                                      Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 24 of 27)
SHINE Medical Technologies                  7.5-77                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 25 of 27)
SHINE Medical Technologies                  7.5-78                                    Rev. 5
 
Proprietary Information - Withheld from public disclosure under 10 CFR 2.390(a)(4)
Export Controlled Information - Withheld from public disclosure under 10 CFR 2.390(a)(3)
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                            Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 26 of 27)
SHINE Medical Technologies                  7.5-79                                    Rev. 5
 
Engineered Safety Features Chapter 7 - Instrumentation and Control Systems                                                                          Actuation System Figure 7.5 ESFAS Logic Diagrams (Sheet 27 of 27)
ALARM PROVIDED TO PROCESS INTEGRATED        RM A                                                                  RADIATION MONITOR CONTROL SYSTEM INDICATION PROVIDED TO PROCESS INTEGRATED                                                                                SIGNAL I                                                      LS              LEVEL SWITCH CONTROL SYSTEM                                                                                          JUNCTION OR                  LOGICAL OR GATE                  ZI    DISCREET POSITION INDICATION                                    NO JUNCITON AND                LOGICAL AND GATE                CT      CONDUCTIVITY TRANSMITTER LOGICAL NOT OR INVERTER GATE              PT        PRESSURE TRANSMITTER                              ACRONYMS APL - ACTUATION AND PRIORITY LOGIC XNOR              LOGICAL XNOR GATE                  TT        TRITIUM TRANSMITTER DIV - DIVISION EIM - EQUIPMENT INTERFACE MODULE XOR              LOGICAL XOR GATE                  TE        TEMPERATURE ELEMENT FNHS - FACILITY NITROGEN HANDLING SYSTEM HWMI - HARDWIRED MODULE INPUT 2/3        TWO-OUT-OF-THREE VOTING GATE              CO    CARBON MONOXIDE TRANSMITTER IU - IRRADIATION UNIT IXP - IODINE AND XENON PURIFICATION SYSTEM 1/2          ONE-OUT-OF-TWO VOTING GATE                FT          FLOW TRANSMITTER MEPS - MOLYBDENUM EXTRACTION AND PURIFICATION SYSTEM BISTABLE - INCREASING SETPOINT                                              N2PS - NITROGEN PURGE SYSTEM OR DISCREET ACTIVE                DI            DISCRETE INPUT PICS - PROCESS INTEGRATED CONTROL SYSTEM BISTABLE - DECREASING SETPOINT                                                PVVS - PROCESS VESSEL VENTILATION SYSTEM OR DISCREET INACTIVE              CF          CALCULATED FLOW RCA - RADIOLOGICAL CONTROLLED AREA RLWI - RADIOLOGICAL LIQUID WASTE IMMOBILIZATION PB                      PUSH BUTTON                  (A)        AUTOMATIC ACTUATION RVZ1 - RADIOLOGICAL VENTILATION ZONE 1 RVZ2 - RADIOLOGICAL VENTILATION ZONE 2 TWO POSITION HAND SWITCH              (M)          MANUAL ACTUATION HS RVZ3 - RADIOLOGICAL VENTILATION ZONE 3 TIMER THAT INITIATES ON A LOGIC 1, RESETS ON                                      SBM - SCHEDULING AND BYPASS MODULE T = XX                                                (E)    ENABLE NONSAFETY ENABLED LOGIC 0 AND OUTPUTS A LOGIC 1 IF TIMER Seconds HAS EXPIRED                                                      SBVM - SCHEDULING, BYPASS, AND VOTING MODULE SFM - SAFETY FUNCTION MODULE (D)    ENABLE NONSAFETY DISABLED TPS - TRITIUM PURIFICATION SYSTEM TSPS - TARGET SOLUTION PREPARATION SYSTEM VTS - VACUUM TRANSFER SYSTEM SHINE Medical Technologies                                          7.5-80                                                                Rev. 5
 
SHINE facility control room contains the necessary workstations, displays, and control inets needed for the operation of the main production facility. The facility control room is ted in the non-radiologically controlled area of the main production facility.
hin the facility control room, there is a main control board, two process integrated control tem (PICS) operator workstations, two neutron driver assembly system (NDAS) workstations, a supervisor workstation. The operator workstations consist of display screens and human rface equipment, and the main control board consists of a console, static display screens, manual actuation interfaces. The supervisor workstation is similar to the PICS operator kstations, but is typically used for monitoring purposes only, and is not normally assigned any trol functions. The main control board, PICS operator and supervisor workstations, and ociated control equipment are considered part of the PICS. The PICS provides nonsafety-ted system status and measured process variable values for viewing, recording, and trending e facility control room (Subsection 7.3.3.1). The main control board, PICS and NDAS rator workstations, and supervisor workstation are not credited with performing safety tions and only assist operators in performance of normal operations or diverse actuations to safety systems.
SHINE facility additionally contains local control stations with limited functionality used for orming specific local tasks.
1        DESCRIPTION 1.1          Main Control Board main control board is located on the east wall of the facility control room between the two ances to the room, as shown in Figure 7.6-1. The main control board is approximately 25 feet e and contains eight sections each containing one column of displays dedicated to a single diation unit (IU), and a ninth section containing two columns of displays dedicated to other cesses within the facility. The ninth section, for the facility generally, is located between the th and fifth IU sections.
static display screens, which show the variables important to the safety functions of the IUs other facility processes, are located on the upper half of the main control board, aligned in e rows of displays. The configuration of the main control board, including the location of the ic display screens, is shown in Figure 7.6-2. The static display screens are used by the rator to verify the status of the main production facility. The current mode of operation for h IU is displayed on a static display screen associated with that IU.
nual actuation interfaces (i.e., physical push buttons and switches), which provide diverse ans to actuate automated safety functions, are located in the space directly below the static lay screens at each main control board section, as shown in Figure 7.6-2. In the same area he manual actuation interfaces, there is an enable nonsafety switch (labeled E/D for able/Disable) for each IU section and for the facility process section, which allows operators nable the PICS ability to manipulate equipment that can also be actuated by the target tion vessel (TSV) reactivity protection system (TRPS) or the engineered safety features ation system (ESFAS). Manual actuations are not required to ensure adequate safety of the lity, as described in Chapter 13.
NE Medical Technologies                      7.6-1                                          Rev. 2
 
1.2          Operator Workstation re are four desks that make up the main operator workstations, centrally located within the lity control room, aligned end-to-end in front of the main control board. The two outermost ks are designated as PICS workstations and the two inner desks are NDAS control stations.
h workstation contains multiple display screens. Configuration of the operator workstations is wn in Figure 7.6-1.
er PICS workstation can display any of the available PICS display screens for monitoring poses. PICS controls are designed such that they can only be manipulated by a single station ny given time to prevent two operators from inputting conflicting commands. While control of h IU or process is normally assigned to a particular workstation, control can also be sferred between workstations for operational flexibility. Control of a process or IU may also ransferred to the supervisor workstation if necessary (e.g., to perform maintenance on an rator workstation, or to accommodate additional workload). A limited set of control functions be transferred to local control stations as described in Subsection 7.6.1.6. Only one kstation (operator, supervisor, or local) is allowed to input control commands to a particular ponent at any time.
of the screens at the PICS workstation is used to display the alarms present in the facility.
screen is designated as monitoring only so that, when an alarm is present, the screen omatically changes the content displayed to the current alarms that are present without rrupting a control process. The remaining screens can be used for control or monitoring as operator tasks demand.
des of operation for the IUs are advanced by the operator at the PICS operator workstation ugh the use of the equipment control screens. Even though the operator has the ability to ance the mode of operation at the workstation, maintaining the current mode of operation is e in the safety-related control systems. If permissive conditions are not met to achieve the t mode of operation, the operator will not be able to move on to the following mode of ration until permissive conditions have been achieved.
two NDAS control stations allow operators to monitor and make adjustments to any of the t neutron drivers in the eight IU cells. The NDAS control stations are only allowed to provide trol signals to the NDAS when a permissive provided by the PICS is satisfied. The NDAS trol stations are used to interface with the vendor provided NDAS control system described in section 4a2.3.4.
1.3          Supervisor Workstation supervisor workstation is located on an elevated platform on the west side of the facility trol room facing the operator workstations and the main control board. The supervisor kstation is similar to the PICS operator workstations, and may be used to control a process or but is normally used for monitoring facility status only. The supervisor station does not have NDAS control capabilities.
NE Medical Technologies                      7.6-2                                      Rev. 2
 
TRPS/ESFAS maintenance workstations receive diagnostic and indication information from TRPS and the ESFAS. Any module failure or warning is shown at the maintenance kstation and a log of each failure or warning is maintained at the maintenance workstation for
. The maintenance workstation is also used to update setpoints within the safety function dule in the chassis. This update is done through a temporary connection to the monitoring and cation communication module of the associated division, as described in Subsection 7.4.5.
TRPS/ESFAS maintenance workstations are provided in the facility control room.
ntenance workstations are integrated into two of the TRPS cabinets, for use by both TRPS ESFAS. The Division A maintenance workstation is located in a Division A TRPS cabinet, the Division B maintenance workstation is located in a Division B TRPS cabinet. The sion A maintenance workstation can also be used for performing maintenance on Division C inets. The typical arrangement of the maintenance workstation in a TRPS cabinet is shown in ure 7.6-3.
1.5          Other Control Room Interface Equipment SHINE facility control room also contains the following equipment used for monitoring or rfacing with facility systems:
iticality accident alarm system (CAAS) panel is located along the east wall of the control m, north of the main control board. The CAAS panel contains a logical unit for processing ms and is used to monitor the status of the CAAS. The CAAS is described in section 6b.3.3.
e control panel is located along the west wall of the control room, north of the supervisor ion. The fire control panel is used to monitor for facility fire alarms provided by the facility fire ection system. The facility fire protection system is described in Subsection 9a2.3.7.
1.6          Local Control Stations SHINE main production facility contains eight local PICS control stations:
* Target solution preparation
* Radioactive liquid waste immobilization
* Supercell A
* Supercell B
* Supercell C
* Tritium purification system (TPS) Train A
* TPS Train B
* TPS Train C pecific, limited set of control functions associated with each local control station can be sferred from the control room to the specified local control station with authorization of a trol room supervisor. The local control stations can also be used for monitoring only for PICS lays not associated with the function of the local control station. The local control stations h contain display and human system interface capabilities.
NE Medical Technologies                      7.6-3                                          Rev. 2
 
SHINE facility additionally contains local control stations for vendor provided nonsafety-ted control systems. The vendor provided nonsafety-related control systems are further cribed in Subsection 7.3.2.
building automation system contains two control stations, one located in the resource ding and the other located in the main production facility mezzanine. The control stations are d for periodic adjustments and maintenance on systems served by the building automation tem and is not used for normal operation.
supercell contains an operator interface for the supercell control system used for controlling cell functions.
radioactive liquid waste immobilization (RLWI) system contains an operator interface for the WI control system for controlling RLWI equipment functions.
ortable NDAS local control station is provided for controlling one NDAS unit at a time during ntenance and commissioning. The station performs the same functions as the control room AS control station, but is not normally connected to an NDAS unit, and is not used for normal ration. The NDAS local control station is also used for controlling an NDAS unit located in the AS service cell.
2        DESIGN CRITERIA re are no SHINE facility design criteria that are uniquely applicable to the control console and lay instruments (other than criteria 1-8 identified in Section 3.1, Tables 3.1-1 and 3.1-2, ch are generically applicable to the facility as a whole). The system design criteria applicable he control console and display instruments are addressed in this section.
2.1        SHINE Facility Design Criteria re are no SHINE facility design criteria that are uniquely applicable to the control console and lay instruments.
2.2        System Design Criteria 2.2.1      Access Control PICS Criterion 10 - The operator workstation and main control board design shall incorporate design or administrative controls to prevent or limit unauthorized physical and electronic access to critical digital assets (CDAs) during the operational phase, including the transition from development to operations. CDAs are defined as digital systems and devices that are used to perform or support, among other things, physical security and access control, safety-related functions, and reactivity control.
sical access to the control room and access to the equipment within is controlled as cribed in Subsection 7.6.3.4. The PICS does not allow remote access and includes the NE Medical Technologies                      7.6-4                                        Rev. 2
 
2.2.2        Software Requirements Development PICS Criterion 11 - A structured process, which is commensurate with the risk associated with its failure or malfunction and the potential for the failures challenging safety systems, shall be used in developing software for the operator workstations and the main control board.
development of software for the PICS, which includes the PICS operator workstations and main control board, follows a structured process as described in Subsection 7.3.3.4. The elopment of software for the NDAS workstation follows the structured process described in section 7.3.3.4.
PICS Criterion 12 - The operator workstation and main control board development lifecycle phase-specific security requirements shall be commensurate with the risk and magnitude of the harm that would result from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the operator workstation and main control board and display instruments.
security requirements imposed on the PICS, which includes the PICS operator workstations the main control board, are described in Subsection 7.3.3.5. Security requirements imposed ng the development of NDAS controls are also described in Subsection 7.3.3.5.
PICS Criterion 13 - The operator workstation and main control board software development lifecycle process requirements shall be described and documented in appropriate plans which shall address verification and validation (V&V) and configuration control activities.
PICS software, including the operator workstation and main control board software, is eloped in accordance with the PICS validation master plan, which addresses V&V and figuration control activities, as described in Subsection 7.3.3.4.
PICS Criterion 14 - The operator workstation and main control board configuration control program shall assure that the required hardware and software are installed in the appropriate system configuration and ensure that the correct version of the software/firmware is installed in the correct hardware components.
PICS validation master plan assures that the required PICS hardware and software are alled in the appropriate system configuration and ensures that the correct version of the dware/firmware is installed in the correct hardware components as described in section 7.3.3.4. Configuration control of the NDAS control system is also described in section 7.3.3.4.
2.2.3        General I&C Requirements PICS Criterion 15 - The main control board shall be functional, accessible within the time constraints of operator responses, and available during operating conditions to confirm safety system status.
NE Medical Technologies                      7.6-5                                        Rev. 2
 
PICS Criterion 16 - Loss of power, power surges, power interruption, and any other credible event to the operator workstations shall not result in spurious actuation or stoppage of any system displaying variables important to the safe operation of the safety systems.
s of power, power surges, or power interruption to the operator workstations does not result change of position of any controlled components nor does it result in the loss of displaying uired parameters from TRPS (Table 7.4-1) or ESFAS (Table 7.5-1) on the main control board.
PICS Criterion 17 - Displays of variables important to the safe operation of the SHINE facility that the operator shall monitor to keep variables within a limiting value, and those that can affect reactivity of the target solution vessel, shall be readily accessible and understandable to the operator.
ameters required to be displayed per TRPS (Table 7.4-1) and ESFAS (Table 7.5-1) are layed on the main control board and are accessible from the operator and supervisor kstations. Display and control functions are further described in Subsection 7.6.3.1.
2.2.4        Independence PICS Criterion 18 - Operator workstations and the main control board, where associated with both safety and nonsafety functions, shall not impede execution of the safety function.
PICS outputs to TRPS and ESFAS will not impede on the ability of the safety systems to cute their safety functions due to the prioritization of safety signals in the TRPS and ESFAS bsections 7.4.3.12 and 7.5.3.11) and the use of the enable nonsafety switch bsections 7.4.3.3 and 7.5.3.2).
PICS Criterion 19 - The operator workstations and main control board data that is transmitted to remote displays shall be protected by one-way communication through the use of hardware devices to a processor that is protected by a firewall.
PICS communication to displays external to the PICS is controlled through one-way data es such that no communication outside of the PICS can have an impact on the operation of PICS (Subsection 7.6.4.5) 2.2.5        Fail Safe PICS Criterion 20 - The operator workstations and main control board shall be designed to assume a safe state on loss of electrical power or exposure to adverse environments.
s of power to the operator workstations or main control board does not result in a change of ition for any controlled components. The control room is not an adverse environment and is ntained at an acceptable temperature for continued equipment operation for at least two rs following a loss of ventilation (Subsection 7.6.3.2).
NE Medical Technologies                      7.6-6                                        Rev. 2
 
of normal electrical power.
al batteries are provided for PICS servers, the operator workstations, and the main control rd such that the PICS continues to operate for at least 10 minutes after a loss of external er. The standby generator system (SGS) provides backup power to the PICS if normal power terrupted (Subsection 7.6.3.5).
2.2.6        Surveillance PICS Criterion 22 - The operator workstations and main control board shall be readily testable.
operator workstations and main control board are part of the PICS. In-service self-testing abilities of the PICS are described in Subsection 7.6.4.5.
2.2.7        Human Factors PICS Criterion 23 - Human factors shall be considered at the initial stages and throughout the operator workstation and main control board design process to ensure that the outputs and display devices showing irradiation unit and process facility status are readily observable by the operator while the operator is positioned at the controls and manual actuation switches.
design of the facility control room, display screens, and operator interfaces incorporates an factors engineering principles (Subsection 7.1.5). Displays that an operator may use to orm a task are placed such that they are visible from the operator workstation, with the lays most frequently used being placed closest to the operator. The supervisor workstation is ed and arranged so that the supervisor has a visual of both operator workstations, the lays that the operators are working from, and the main control board (Subsection 7.6.3.3).
2.2.8        Annunciators PICS Criterion 24 - Alarms and annunciators shall clearly show the status of the operating systems, interlocks, engineered safety feature initiations, confinement status, and radiation fields and concentration.
m indication is provided on both the operator workstations and the main control board as cribed in Subsection 7.6.4.2. The types of alarms provided, including the status of operating tems, interlocks, engineered safety feature initiations, confinement status, and radiation fields concentration, are described in Subsection 7.3.2.
PICS Criterion 25 - Hardware and software failures shall be assessed in reliability analyses of the annunciators used to support normal and emergency operations.
annunciators are integral to the PICS and are not designed as a separate system.
rational qualification testing of the PICS is performed as described in Subsection 7.3.3.4.
dware testing of the PICS is performed as described in Subsection 7.3.4.2.
NE Medical Technologies                      7.6-7                                      Rev. 2
 
PICS Criterion 26 - Controls over the design, fabrication, installation, and modification of the operator workstations and main control board shall conform to commercial quality standards following accepted engineering and industrial practices..
PICS operator workstations and main control board are part of the PICS and are designed, icated, and installed in accordance with the PICS validation master plan, which includes visions for operational qualification testing as described in Subsection 7.3.3.4. The NDAS trol stations are designed, fabricated, and installed in accordance with vendor procedures roved by SHINE. During facility operation, modifications to either the PICS or NDAS controls controlled in accordance with SHINE work control processes.
3        DESIGN BASIS 3.1        Display and Control Functions h IU-specific set of static display screens on the main control board indicates variables ortant for verifying proper operation of safety systems following automatic actuation of the PS. The facility process set of static display screens indicates variables important for verifying per operation of safety systems used in other facility systems following automatic actuation of ESFAS. Each set of static display screens on the main control board is used to support an rator in performing manual actuation of a safety function. Manual actuations are performed the main control board, where the static display screens are visible from the manual ation push buttons.
PICS operator workstations have multiple equipment control display screens available to port normal control functions and provide indication of alarms. The PICS display screens e the capability of providing at least 30 minutes of data trending from instrumentation ables obtained from the ESFAS, TRPS, and those variables associated with identifying a ach of the primary system boundary or determining and assessing the magnitude of oactive material release to assist operators actions. Operator interaction with the equipment trol display screens is through a keyboard and mouse interface.
supervisor workstation provides displays so that the supervisor can select and monitor the ropriate screen applicable to the current tasks being performed by the operator. Control of ct processes or IUs may be transferred to the supervisor workstation at the discretion of the trol room supervisor.
NDAS control stations display variables associated with the neutron drivers located in each The NDAS interface is used by operators to monitor and make adjustments to the neutron ers in the eight IU cells. Each NDAS control station has the ability to monitor and control any he eight neutron drivers, but the NDAS control station is only allowed to provide control als to an NDAS unit when a permissive provided by the PICS is satisfied. The NDAS control ion permissive is enabled or disabled using the PICS operator (or supervisor) workstation.
ectively enabling this control permissive is used to prevent both NDAS control stations from viding conflicting commands to a single NDAS unit.
NE Medical Technologies                      7.6-8                                        Rev. 2
 
operator workstations and the main control board are designed to operate in the normal ironmental conditions of the facility control room, presented in Table 7.2-2. The main control rd equipment is designed to operate in the transient environmental conditions listed in le 7.2-2 for a minimum of two hours after initiation of a protective action resulting from a ign basis event.
he event of a loss of ventilation to the facility control room, the environment within the facility trol room is calculated to remain below 120ºF after two hours. This result is based on the wing assumptions:
* Initial facility control room temperature: 75ºF
* Outdoor air temperature: 102.6ºF
* Facility control room occupancy: 10
* Facility control room equipment load: 29 kW resultant temperature is within the temperature indicated in Table 7.2-2 for at least two rs, which is sufficient time to ensure that safety-related equipment is able to perform its safety tion if required. Therefore, no safety-related ventilation or cooling systems are required to ure the safety-related I&C systems located in the control room can continue to perform their ty function as required.
3.3            Human Factors design of the facility control room, display screens, and operator interfaces incorporates an factors engineering principles via the implementation of the human factors engineering gram. The layout of screens presenting the same set of information at multiple locations is tical for each (i.e., PICS operator workstation, supervisor workstation, local control station, or n control board). The displays and controls are generally grouped by system to aid the rator in the recognition and operation of the controls.
supervisor workstation is placed and arranged so that the supervisor has a visual of both rator workstations, the displays that the operators are working from, and the main control rd. Operator workstations are oriented such that the main control board static display screens directly in front of the operator workstation.
manual actuation push buttons are located directly below the static display screens so that operator can be directly monitoring the variables important to the safe operation of the facility n the manual actuation is performed. The use of selector switch and push buttons in the e product line ensures consistency in look and function. These push buttons also include a itive position indication and a protective guard to prevent inadvertent actuation.
described in Subsections 7.4.2.2.14 and 7.5.2.2.14, human factors is a design consideration TRPS and ESFAS. Modifications to safety-related I&C systems after the SHINE facility is in ration include human factors considerations. Issues related to human factors are identified tracked to resolution using the corrective action program.
NE Medical Technologies                      7.6-9                                        Rev. 2
 
ess is administratively controlled to both the facility control room and the facility control tems. The facility control room is located within the main production facility, and personnel ess to the control room and the main production facility is controlled in accordance with lity procedures. The PICS does not allow remote access and does not use any wireless rface capabilities for control functions, as described in Subsection 7.3.3.5. Access control for ty-related control systems is described in Subsection 7.4.4.1.3.
of the PICS, including use of the local control stations, requires the user to log in using a sonal username and password. Additionally, the use of a local control station is required to be horized via PICS permissions by a control room supervisor to prevent unauthorized use.
usage of portable storage devices or other personal electronic equipment is controlled by lity procedures.
3.5          Loss of External Power al batteries are provided for PICS servers, the operator workstations, and the main control rd such that the PICS continues to operate for at least 10 minutes after a loss of external er. The SGS provides backup power to the PICS if normal power is interrupted.
4        OPERATION AND PERFORMANCE 4.1          Displays plays of information related to the operation of the main production facility are available to the rator on the workstations and the main control board. The displays at each of the operator kstations, supervisor workstation, and main control board are digital displays. Displays are gramed such that the range of the displayed information includes the expected range of ation of the monitored variable.
h of the variables listed in Table 7.4-1 and Table 7.5-1 is continuously displayed on the static lays of the main control board. The position indication of actuation components identified in tions 7.4 and 7.5 is also available on the static display screens.
iables available to the PICS, including the variables from Table 7.4-1 and Table 7.5-1, are ilable for display on the various PICS displays at the operator workstations and supervisor kstation.
play of interlock and bypass status is available on each of the PICS displays of the equipment trol display screens for the equipment or instrument channel that has been bypassed.
assed channels for the safety systems are also visible on the maintenance workstation.
uded in displayed variables at the PICS operator workstation displays, the following variables ociated with a breach of the primary system boundary are uniquely identified:
* TSV level
* TSV dump tank level NE Medical Technologies                    7.6-10                                          Rev. 2
 
vided for display at the operator workstations:
* Stack release monitor emissions
* Carbon delay bed effluent monitor emissions
* Radiological ventilation zone 1 (RVZ1) radiologically control area (RCA) exhaust radiation detectors emissions
* Radiological ventilation zone 2 (RVZ2) RCA exhaust radiation detectors emissions iation monitoring information is conveyed from the radiation monitoring instruments cribed in Section 7.7 to the PICS and displayed in the facility control room. Radiation nitoring information is available on demand at the operator workstations.
play values on each PICS display screen are automatically updated as more current data omes available. Each PICS display screen presented on the operator workstation has a title eader and unique identification to distinguish each display page.
maintenance workstation provides diagnostic information received from the ESFAS and PS on system status to be used as a test interface.
ited function local displays, including radiation monitoring information, are also provided in irradiation facility (IF) and radioisotope production facility (RPF) at select locations bsection 7.6.1.6).
4.2          Alarms ms are integrated into the PICS display systems. The operator workstations provide detailed al alarms to the operator to represent unfavorable status of the facility systems. Indications at operator workstation are provided as visual feedback as well as visual features to indicate systems are operating properly.
cation of alarms present is also provided for each IU and for the facility process systems at main control board. Configurable stacklights are mounted above the main control board to vide audible and visual alarm indication. Alarms are provided to inform the operator of off-mal operating system status, interlocks, engineered safety feature initiations, confinement us, and radiation fields and concentration. Alarms are evaluated with respect to human ors engineering design guidelines. This evaluation is performed as part of initial installation future modifications.
ms for facility systems are further described in Subsection 7.3.2.
4.3          Controls nual controls are provided on both of the PICS operator workstations, via input to the PICS, on the main control board.
nual controls for the safety-related TRPS and ESAFS protective functions are located at the n control board. Nonsafety manual push buttons that provide a diverse actuation to the omatically generated safety actuations are located directly below the static display screens for NE Medical Technologies                      7.6-11                                        Rev. 2
 
ation components or to reset the safety-related control systems using the PICS following the ation of a protective function. The enable nonsafety switch is a two-position switch with es for Enable and Disable. To provide the operators the ability to place the facility into the ility Secure state, a single manual key switch is located at the facility process section of the n control board below the static display screens. The switch has two positions of operation, ured and Operating.
nual actuation inputs from the main control board are connected downstream of the safety-ted control system programmable logic functions as described in Subsection 7.4.5.2.4.
trols for normal operation are provided at the operator workstations. Multiple equipment trol displays are set up at each operator workstation for operators to select the PICS (or AS) display screen that coincides with the task that the operator is currently performing.
rface with the equipment control displays is through a keyboard and mouse provided for each rator workstation. Distribution of controls between the two PICS operator workstations, the ervisor workstation, and the local PICS control stations is provided, such that each PICS rator workstation is normally assigned a specific set of IUs or processes for which the PICS lays provide control functions. The supervisor workstation is not normally assigned control tions, and the local PICS control stations are only assigned limited control functions when roved by a control room supervisor. For PICS display screens where the station has not been igned a control function, the PICS displays provide monitoring capabilities only. Limiting trol capabilities for each IU or facility system or process to a single workstation at a given time vent two operators from entering conflicting commands to a single component or process. On ilure of one PICS operator workstation, control functions assigned to that station can be sferred to the remaining PICS operator workstation or the supervisor workstation.
NDAS control stations can each provide control of any of the eight neutron drivers, but each AS control station can only provide control commands to one neutron driver at any given time.
4.4          Information Retrieval variables monitored by each of the safety systems, radiation monitoring systems, and the S are recorded into a data historian. The PICS obtains the information that is to be recorded provides that information to the facility data and communication system (FDCS) where the a historian is located. The data historian provides the ability to retrieve post-event data ing. Through the use of the information provided to the FDCS, off-site monitoring is provided.
rmation from the FDCS historian is able to be retrieved by operations personnel in the facility trol room on demand.
4.5          Reliability al batteries are provided for PICS servers, the operator workstations, and the main control rd to ensure the PICS continues to operate for at least 10 minutes after a loss of external er event and the SGS provides backup power to the PICS if normal power is interrupted bsection 7.6.3.5).
play screens in the facility control room are industrial flat panel displays to ensure compliance electromagnetic compatibility requirements in an industrial setting.
NE Medical Technologies                      7.6-12                                        Rev. 2
 
munications from the safety systems to the nonsafety system. There are no unidirectional munications that allow the nonsafety system to communicate back to the safety systems venting the ability to propagate a failure from the nonsafety control system displays to the ty control systems. The PICS communication to the FDCS is through a one-way data diode h that no communication from outside of the PICS (other than the inputs from the safety-ted control systems) can have an impact on the operation of the PICS. Communications of indication and diagnostic information of the TRPS and ESFAS to the maintenance kstation are through a unidirectional point-to-point communication bus so that the ntenance workstation does not have an effect on the TRPS or ESFAS.
ilure in the display systems results in distinct display changes, which directly indicate that icted plant conditions are invalid.
PICS is designed in a manner that allows operators to remove static display screens and ipment control displays from service without impacting the operation of the remaining ions of the PICS displays.
PICS has in-service self-testing capabilities such that the system will alarm if individual ts or an entire rack or cabinet loses communications or faults.
4.6            Technical Specifications and Surveillance tain material in this section provides information that is used in the technical specifications.
includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced in, the bases that are described in the technical specifications.
5        CONCLUSION SHINE facility control room is located in the non-radiologically controlled area of the main duction facility and contains the necessary workstations, displays, and control cabinets ded for the operation of the main production facility. The main control board, PICS operator supervisor workstations, and associated control cabinets are considered part of the PICS.
part of the PICS, the main control board, operator workstations, and supervisor workstation not credited with performing safety functions and only assist operators in performance of mal operations or diverse actuations to the safety systems. The PICS interfaces with the ty-related TRPS, ESFAS, NFDS, and safety-related radiation monitors to provide nonsafety-ted system status and measured process variable values for viewing, recording, and ding.
trol interfaces are also provided both in the control room and locally in the SHINE facility for er vendor provided nonsafety-related control systems that interface with the PICS.
control console and display instruments are designed for functionality and high reliability.
control console and display instruments are designed for the normal environment and for cified time intervals following a design basis event or loss of ventilation. No safety-related tilation or cooling systems are required for the facility control room.
NE Medical Technologies                    7.6-13                                        Rev. 2
 
NE Medical Technologies 7.6-14 Rev. 2 Main Control Board                  Main Control Board IU Section                  Facility Status Section Static Display    Static Display                  Static Display Screen            Screen                          Screen Static Display    Static Display                  Static Display Screen            Screen                          Screen Static Display    Static Display                  Static Display Screen            Screen                          Screen E D                O S                            E D NE Medical Technologies          7.6-15                                            Rev. 2
 
MI CM TRPS SFMs        SVMs    EIMs          IU Cell 1 MWS MI CM TRPS SFMs        SVMs    EIMs          IU Cell 2 NE Medical Technologies                7.6-16                                  Rev. 2
 
section describes systems and components that perform radiation monitoring functions in the SHINE facility. Radiation monitoring systems and components include:
* safety-related process radiation monitors included as part of the engineered safety features actuation system (ESFAS), target solution vessel (TSV) reactivity protection system (TRPS), and tritium purification system (TPS);
* nonsafety-related process radiation monitors included as part of other facility processes;
* area radiation monitoring consisting of the radiation area monitoring system (RAMS);
* continuous air monitoring consisting of the continuous air monitoring system (CAMS);
and
* effluent monitoring consisting of the stack release monitoring system (SRMS).
objective of the radiation monitoring systems is to:
* provide facility control room personnel with a continuous record and indication of radiation levels at selected locations within processes and within the facility;
* provide local radiation information and alarms for personnel within the facility;
* provide input to safety-related control systems to actuate safety systems; and
* provide the ability to monitor radioactive releases to the environment.
agram showing how the facility radiation monitoring systems relate to the overall facility rumentation and control (I&C) architecture is provided as Figure 7.1-1.
1        SAFETY-RELATED PROCESS RADIATION MONITORING 1.1          System Description ety-related process radiation monitors provide input to the safety-related ESFAS or TRPS trol systems. These components monitor for either fission products or tritium. The type of ty-related process radiation monitor (fission product or tritium) is selected based on the tion and identity of radioactive material present. Beta detection radiation monitors monitor for eous fission product release and provide input to the ESFAS or TRPS. Gamma-ray radiation nitors monitor for release of fission products through leakage into the molybdenum extraction purification system (MEPS) hot water loop and provide input to the ESFAS. Safety-related m monitors are part of the TPS. The TPS monitors are installed within various portions of the to detect potential tritium releases, provide actuation signals to the ESFAS controls, and vide interlock inputs to the TRPS controls. Information from safety-related process radiation nitors is displayed in the facility control room on the operator workstations (via the process grated control system [PICS]).
st of safety-related process radiation monitors is provided in Table 7.7-1.
ic diagrams depicting how the safety-related process radiation monitors provide inputs to PS and ESFAS are provided in Figure 7.4-1 and Figure 7.5-1, respectively.
NE Medical Technologies                      7.7-1                                        Rev. 4
 
SHINE facility design criteria applicable to the safety-related process radiation monitors are ressed in this section. SHINE facility design criteria 13 and 38 apply to the safety related ation monitors.
1.2.1        Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
ety-related radiation monitoring channels produce a full-scale reading when subject to ation fields higher than the full-scale reading; however, they are expected to remain on-scale ng accident conditions. The safety-related process radiation monitors that provide actuation als are designed to function in the range necessary to detect accident conditions and provide ty-related inputs to the ESFAS and TRPS control systems (Subsection 7.7.1.3.1). Setpoints selected based on analytical limits and calculated to account for known uncertainties in ordance with the setpoint determination methodology and the monitors are periodically tionally tested and maintained (Subsection 7.7.1.4.3).
1.2.2        Monitoring Radioactivity Releases SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
safety-related process radiation monitors provide radiation monitoring for the primary finement boundary, hot cell, and glovebox atmospheres, provide radiation monitoring of the PS hot water loop, and monitor effluent release paths (Subsection 7.7.1.4.1). The monitors designed to operate during normal conditions, anticipated transients, and design basis idents (Subsection 7.7.1.4).
1.3          Design Bases 1.3.1        Design Bases Functions safety functions of the process radiation monitors are: (1) to detect radioactivity in excess of mal levels and provide an actuation signal to the ESFAS or TRPS controls, or (2) to provide t to TRPS for interlocking the operation of the neutron driver. Additional discussion of TRPS ESFAS functions, interlocks, and bypasses is provided in Section 7.4 and Section 7.5, pectively.
NE Medical Technologies                    7.7-2                                          Rev. 4
 
cess radiation monitors (channels) is only required to be operable when the location being nitored contains radioactive material, as specified in Table 7.7-1.
cess radiation monitors are selected for compatibility with the normal and postulated accident ironmental and radiological conditions.
st of safety-related process radiation monitors, specifying the monitored location, number of sing channels provided, and operability requirements, is provided in Table 7.7-1.
variables to be monitored and their ranges, accuracies, setpoints, and response times of ty-related process radiation monitors are provided in Table 7.4-1 and Table 7.5-1. Instrument uracies are appropriate for the associated setpoints. Signal processing time for the ESFAS TRPS is provided in Subsection 7.4.5.2.3.
ety-related radiation monitoring channels produce a full-scale reading when subject to ation fields higher than the full-scale reading, however, they are expected to remain on-scale ng accident conditions. The safety-related process radiation monitors that provide actuation als are designed to function in the range necessary to detect accident conditions and provide ty-related inputs to the ESFAS and TRPS control systems. For defense-in-depth, the ologically controlled area (RCA) exhaust, general area direct radiation levels, and general a airborne particulates are monitored by stack release, radiation area, and continuous area nitors, respectively.
1.3.2        Operating Conditions ing normal operation, the process radiation monitors are designed to operate in the normal ironmental conditions (temperature, pressure, relative humidity) identified in Tables 7.2-2 ugh 7.2-5 for an expected 20-year lifetime of the equipment.
monitors are designed to operate in the transient conditions identified in Tables 7.2-1 ugh 7.2-5 until the associated protective function has continued to completion.
1.3.3        Single Failure east two process radiation monitors are provided for each protection function input parameter, h providing input to the associated division of the safety-related control system. Redundancy onitors ensures that a failure of one monitor will not prevent the control system from orming its safety function.
Channel A process radiation monitors receive power from Division A of the uninterruptible er supply system (UPSS), and Channel B monitors receive power from UPSS Division B.
nnel C monitors, when provided, receive auctioneered power from both UPSS Division A B.
refore, no single failure of a detector, control division, or power division will prevent the ty-related control system from performing its safety function.
NE Medical Technologies                      7.7-3                                          Rev. 4
 
ety-related process radiation monitors provide analog communication to the ESFAS and PS controls. Channel communication independence is maintained by implementing separate dwired connections to the separate ESFAS or TRPS controls divisions.
iation monitoring data provided to nonsafety control systems is through one-way isolated puts.
ety-related process radiation monitors from separate divisions are physically separated from h other and independently powered from the associated UPSS division.
1.3.5        Redundancy h location that requires engineered safety features to actuate in response to radiation levels, etermined by the safety analysis, is provided with at least two independent safety-related cess radiation monitors, designated as Channels A and B. For locations where spurious ation of a process radiation monitor could significantly impact overall facility operation, a third sing division (Division C) is provided.
1.3.6        Human Factors, Display and Recording ection and display of process radiation monitor variables are designed with consideration of an factors engineering principles.
Section 7.6 for additional discussion of information presented to facility operators and orded for future use.
1.3.7        Fire Protection ety-related monitors in different channels are located in separate fire areas when practical.
sical separation is used to achieve separation of redundant sensors. Wiring for redundant nnels uses physical separation and isolation to provide independence for circuits. Separation iring is achieved using separate wireways and cable trays for each channel. Spatial aration between cable and raceway groups is in accordance with IEEE 384-2008 (IEEE, 8), Section 5.1.1.2, Section 5.1.3.3 Table 1, and Section 5.1.4 Table 2.
le, wire, and electrical connectors utilized to connect radiation monitoring components to the FAS or TRPS have certifications that demonstrate the ability to inhibit the propagation of e in the event of a fire. The certifications use recognized industry standards or guidance.
combustible and heat resistant materials are used where practical in the design.
1.3.8        Natural Phenomena Hazards and Dynamic Effects process radiation monitors are installed in the seismically qualified portion of the main duction facility where they are protected from earthquakes, tornadoes, and floods bsections 7.4.3.6 and 7.5.3.5). The process radiation monitors are Seismic Category I, igned in accordance with Section 8 of IEEE Standard 344-2013 (IEEE, 2013)
NE Medical Technologies                      7.7-4                                          Rev. 4
 
1.3.9        Quality safety-related process radiation monitors are designed, procured, fabricated, erected, and ed in accordance with the SHINE Quality Program Description (QAPD). Quality records licable to the design , procurement, fabrication, erection, and testing are maintained.
following codes and standards are applied to the design of the safety-related process ation monitors:
* IEEE 344-2013, Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations (IEEE, 2013), Section 8.
* IEEE 384-2008, IEEE Standard Criteria for Independence of Class1E Equipment and Circuits (IEEE, 2008); invoked for separation of safety-related and nonsafety-related cables and raceways, as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.
1.4          Operation and Performance safety-related process radiation monitors are designed to operate under normal conditions, ng anticipated transients, and during design basis accidents such that they will perform their ty function.
1.4.1        Functionality PS process radiation monitors monitor the ventilation line from the primary closed loop cooling tem (PCLS) expansion tanks (i.e., radiological ventilation zone 1 exhaust subsystem [RVZ1e]
diation unit [IU] cell radiation monitors). These monitors provide an actuation signal when ation levels exceed pre-determined limits, indicative of a release of target solution or fission ducts within the PCLS or the primary confinement atmosphere (with which the tank municates). The actuation results in an IU Cell Safety Actuation for that unit.
FAS process monitors associated with the supercell monitor the ventilation exhaust from each cell and provide an actuation signal when radiation levels exceed pre-determined limits, cative of a release of target solution or fission products within that hot cell. The actuation ults in isolation of the affected hot cell.
FAS process monitors associated with the radiological ventilation zone 1 (RVZ1) and ological ventilation zone 2 (RVZ2) exhaust are designed to provide an actuation signal when ation levels in the RCA ventilation exhaust systems exceed pre-determined limits, indicative failure of a confinement boundary within the facility. The actuation results in isolation of Z1, RVZ2, and radiological ventilation zone 3 (RVZ3) ventilation.
ESFAS process monitors associated with the MEPS hot water loop are designed to provide actuation signal when radiation levels exceed pre-determined limits, indicative of a leak of et solution within the loop. The actuation results in isolation of the affected MEPS hot water NE Medical Technologies                      7.7-5                                        Rev. 4
 
ts, indicative of a failure of TPS process equipment and release of tritium into the TPS ebox. The actuation results in isolation of the tritium confinement and ventilation associated the TPS room.
TPS tritium monitors associated with the TPS exhaust to facility stack are designed to vide an actuation signal when tritium concentrations in the TPS exhaust to facility stack eed predetermined limits, indicative of a release of tritium out of the TPS. The actuation ults in isolation of the TPS process vent exhaust lines and ventilation associated with the TPS m.
itional discussion of safety-related process radiation monitor functionality is provided in tions 7.4 and 7.5.
1.4.2        Reliability, Adequacy, and Timeliness safety-related process radiation monitors are provided for each location requiring nitoring. For locations where spurious actuation of the process radiation monitor could ificantly impact overall facility operation, a third sensing channel (Channel C) is provided for
-out-of-three voting capability.
rument ranges and response times are provided in Tables 7.4-1 and 7.5-1.
1.4.3        Setpoints, Calibration and Surveillance points for safety-related process radiation monitors are selected based on analytical limits calculated to account for known uncertainties in accordance with the setpoint determination hodology described in Subsection 7.2.1.
nitors are periodically functionally tested and maintained in accordance with the SHINE nical specifications to verify operability.
rument background count rate is observed to ensure proper functioning of the monitors.
ety-related process radiation monitors located in a low background area are equipped with a ck source to be able to verify proper operation.
ety-related process radiation monitors are calibrated using commercial radionuclide dards that have been standardized using a measurement system traceable to the National itute of Standards and Technology (NIST).
1.4.4        Technical Specifications tain material in this section provides information that is used in the technical specifications.
includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.
NE Medical Technologies                        7.7-6                                      Rev. 4
 
safety-related process radiation monitoring is provided as part of various systems to provide rmation to the operator on the status and effectiveness of processes. They may be used to nose process upsets but are not relied upon to prevent or mitigate accidents. Nonsafety-ted process radiation monitoring is not used to control personnel or environmental ological exposures.
3        AREA RADIATION MONITORING 3.1          System Description a radiation monitoring within the facility is provided by the RAMS. Area radiation monitors are ted in areas where personnel may be present and where radiation levels could become ificant. The monitors provide local and remote indication of radiation levels and provide local ms to notify personnel of potentially hazardous conditions. The RAMS provides a nonsafety-ted defense-in-depth as low as reasonably achievable (ALARA) function of alerting personnel he need to evacuate an area if required. Personnel entering radiation areas are provided with sonal electronic dosimetry, which serves as the primary means of alerting individuals of the d to evacuate those areas if conditions warrant. Additional discussion of radiation protection ctices is provided in Chapter 11.
h RAMS unit consists of a dose rate meter/controller, Geiger Mueller or silicon detector, local ation level display, audible horn, and an alarm beacon. RAMS unit locations are provided in le 7.7-2.
RAMS also provides remote indication of the radiological status of the facility to control room sonnel. RAMS information is provided on the operator workstations (via the PICS).
MS units are powered from the normal power supply system and provided backup power from standby generator system (SGS). Electrical power systems are discussed further in pter 8.
3.2          Design Criteria SHINE facility design criteria applicable to the RAMS are stated in Chapter 3, Table 3.1-2.
SHINE facility design criteria applicable to the RAMS are addressed in this section.
3.2.1        Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
RAMS monitors gamma radiation levels as described in Subsection 7.7.3.3.1, which cover a ge from low normal background (below the definition of a radiation area) to 100 times the NE Medical Technologies                      7.7-7                                      Rev. 4
 
SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
RAMS monitors the general areas of the plant environs for radioactivity as described in section 7.7.3.1.
3.3          Design Bases 3.3.1        Design Bases Functions RAMS functions continuously to alert facility personnel entering or working in low radiation as of increasing or abnormally high radiation levels which, if unnoticed, could possibly result advertent overexposures. The RAMS also serves to inform the control room operator of the urrence and approximate location of an abnormal radiation increase in low-radiation areas.
h RAMS unit is designed to detect direct radiation from 0.1 mrem/hr up to 10 rem/hr. RAMS s have an accuracy of at least 25 percent of the measured value.
3.3.2        Operating Conditions MS units are designed to operate in the normal environmental conditions presented in les 7.2-1 and 7.2-3.
3.4          Operation and Performance RAMS area radiation monitors are designed to operate under normal facility conditions and etect radiation that may be indicative of anticipated transients or design basis accidents.
RAMS includes the area radiation monitoring units located in the main production facility A.
m setpoints are set conservatively as required to notify workers to potential hazards or ificant changes to radiological conditions in the area.
nitors are periodically calibrated using calibration sources that are traceable to factory tests verified initial calibration and accuracy. The units are calibrated at least annually and as ommended by the instrument manufacturer. Monitors are periodically functionally tested using alled check sources, which simulate a radiation level in the area.
3.4.1        Technical Specifications re are no technical specifications applicable to the RAMS.
NE Medical Technologies                      7.7-8                                        Rev. 4
 
4.1          System Description tinuous airborne contamination monitoring within the facility is provided by the CAMS. Each MS unit samples air and provides real time alpha and beta activities or tritium activity to alert sonnel when airborne contamination is above preset limits. CAMS units are located in areas re personnel may be present and where contamination levels could become significant. Each MS unit provides local and remote indication of airborne radiation levels and alarm abilities. The CAMS provides a nonsafety-related defense-in-depth ALARA function of ting personnel of the need to evacuate an area if required. Additional discussion of radiation ection practices is provided in Chapter 11.
ticulate continuous air monitors are alpha-beta air monitors, which are self-contained units ipped with a vacuum pump, particulate filter, and a silicon-based detector. Real time tritium monitors are self-contained units equipped with a vacuum pump and dual ionization mbers. CAMS unit locations are provided in Table 7.7-3.
MS units are powered from the normal power supply system and provided backup power from SGS. Electrical power systems are discussed further in Chapter 8.
4.2          Design Criteria SHINE facility design criteria applicable to the CAMS are stated in Chapter 3, Table 3.1-2.
SHINE facility design criteria applicable to the CAMS are addressed in this section.
4.2.1        Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
CAMS units monitor alpha and beta airborne activity concentration and tritium airborne vity concentration as described in Subsection 7.7.4.3.1. For alpha and beta airborne activity centration detection, the design range is 10 percent DAC up to 1,000,000 DAC. For tritium orne activity concentration detection, the design range is 5 percent DAC up to 50,000 DAC.
SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
CAMS monitors the facility environment where personnel are normally present and where tamination levels could become significant. The CAMS provides real time sampling for alpha, NE Medical Technologies                      7.7-9                                        Rev. 4
 
4.3          Design Bases 4.3.1        Design Bases Functions CAMS functions continuously to immediately alert facility personnel entering or working in radiation areas of increasing or abnormally high airborne contamination levels which, if oticed, could possibly result in inadvertent overexposures. The CAMS also serves to inform control room operator of the occurrence and approximate location of an abnormal radiation ease in low-radiation areas.
h particulate CAMS unit has a minimum sensitivity of 1E-12 Ci/cc alpha and 1E-10 Ci/cc a, with a span of at least six decades of monitoring capability. Each tritium CAMS unit has a imum sensitivity of 1 Ci/m3, with a span of at least four decades of monitoring capability.
4.3.2        Operating Conditions MS units are designed to operate in the normal environmental conditions presented in le 7.2-3.
4.4          Operation and Performance CAMS airborne contamination monitors are designed to operate under normal facility ditions and to detect radiation that may be indicative of anticipated transients or design basis idents.
CAMS includes the continuous airborne contamination monitoring units located in the main duction facility RCA.
m setpoints are set conservatively as required to notify workers to potential hazards or ificant changes to radiological conditions in the area. Monitors are periodically calibrated g calibration sources that are traceable to factory tests that verified initial calibration and uracy. The calibration of instrumentation is at least annually and as recommended by the rument manufacturer. Operation and response tests of instruments are performed consistent the manufacturers recommendations and are conducted at a frequency consistent with stry practices.
4.4.1        Technical Specifications re are no technical specifications applicable to the CAMS.
5        EFFLUENT MONITORING 5.1          System Description uent monitoring for the facility is provided by the SRMS. The SRMS is composed of two nitoring units: the main facility stack release monitor (SRM), and the carbon delay bed effluent nitor (CDBEM).
NE Medical Technologies                      7.7-10                                          Rev. 4
 
SRM performs its function by drawing a representative air sample from the stack and viding a means to measure the air sample for noble gases (continuous measurement) and turing particulates, iodine, and tritium for collective measurement.
CDBEM monitors for noble gases at the exhaust of the process vessel vent system (PVVS) bon delay beds to provide information about the health of the PVVS carbon delay beds and to vide the ability to monitor the safety-related exhaust point effluent release pathway when it is se. The CDBEM is used on an as needed basis to demonstrate that gaseous effluents from main production facility are within regulatory limits (e.g., during a loss of off-site power when normal heating, ventilation, and air conditioning [HVAC] systems and the PVVS are not rating) and do not have an accident mitigation or personnel protection function. Two iculate and iodine filters (redundant configuration) are provided for in-line capturing and ective measurement when the safety-related exhaust point is in use.
locations of the SRM and CDBEM within the facility ventilation systems are shown in ure 7.7-1.
5.2          Design Criteria SHINE facility design criteria are described in Section 3.1. The SHINE facility design criteria licable to the SRMS are provided in Table 3.1-2.
5.2.1        Applicable Design Criteria SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for postulated accidents as appropriate to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the primary system boundary, the primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
SRMS continuously monitors noble gases that are present in facility effluent streams and ws for the collection and analysis of particulate, iodine, and tritium (Subsection 7.7.5.3.1).
SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents (Subsection 7.7.5.4).
SRM and CDBEM instrument ranges are provided in Subsection 7.7.5.3.1.
SHINE Design Criterion 38 - Means are provided for monitoring the primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material. Potential effluent discharge paths and the plant environs are monitored for radioactivity that may be released from normal operations, including anticipated transients, and from postulated accidents.
SRMS continuously monitors noble gases that are present in facility effluent streams and ws for the collection and analysis of particulate, iodine, and tritium (Subsection 7.7.5.3.1).
SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents (Subsection 7.7.5.4).
NE Medical Technologies                    7.7-11                                        Rev. 4
 
5.3.1      Design Basis Functions SRMS functions to continuously monitor noble gases that are present in facility effluent ams and to allow for the collection and analysis of particulate, iodine, and tritium.
hrouded probe is used in the SRM to withdraw air from the main facility stack flow stream. The be is designed for high efficiency extraction of aerosols from ventilation stacks, meeting uirements for ANSI N13.1-1999 (ANSI, 1999).
SRM noble gas radiation monitor has a range of 1.0E-06 Ci/cc to 1.0E-01 Ci/cc, with a imum sensitivity of 3.1E-07 Ci/cc (xenon-133 equivalent). The SRM tritium monitor has a imum sensitivity of 1.0E-10 Ci/cc.
CDBEM noble gas radiation monitor has a range of 1.0E-06 Ci/cc to 1.0E+01 Ci/cc.
both the SRM and CDBEM, filter medium collection efficiency is 99 percent for 0.3 micron or er particles. Halogen isotopes are collected on a filter having a collection efficiency of percent or better for iodine.
5.3.2      Operating Conditions MS units are designed to operate in the normal environmental conditions presented in le 7.2-3 and the radioisotope production facility (RPF) general area radiological environment sented in Table 7.2-1.
5.3.3      Quality following standard is applied to the design of the facility effluent monitors:
* ANSI N13.1-1999, Sampling and Monitoring Release of Airborne Radioactive Substances from the Stacks and Ducts of Nuclear Facilities (ANSI, 1999) 5.4        Operation and Performance SRMS units are designed to operate under normal facility conditions and to detect radiation may be indicative of anticipated transients or design basis accidents.
SRM is used to monitor the main facility stack, which is the normal release path for gaseous ents from the PVVS and RCA ventilation systems. The SRM includes a mass flow controller egulate sample flow rate in the isokinetic region relative to stack flow. A vacuum pump is used raw sampled air through particulate and iodine filter cartridges, which are removed and lyzed periodically. The sampled air is then drawn into a sample chamber, which houses a a detector used to measure the noble gas radionuclides. The ratemeter for the beta radiation nitor indicates and displays the radiation level inside the sampler from the sampled air. From sampler, the air is drawn through the flow controller assembly, pump, and exhausted into the rn line. Downstream of the particulate and iodine filter, a connection for the tritium detection tem is provided. The tritium monitor has its own pump and flow control. The tritium detector is ssive sampler collecting system (i.e., bubble system) to continuously collect and concentrate NE Medical Technologies                    7.7-12                                          Rev. 4
 
CDBEM monitors noble gases at the exhaust of the PVVS carbon delay beds using a pling system. Redundant particulate and iodine filters are installed in-line with the effluent am, upstream of the safety-related exhaust point, which operates at a much lower flow rate proximately 16 standard cubic feet per minute) than the main facility stack. The safety-related aust point is only used while nitrogen purge is in operation. The PVVS system does not eive gases from process locations expected to contain tritium; therefore, the CDBEM does not ude a tritium monitor. See Section 9b.6 for additional discussion on the PVVS and nitrogen ge operations.
initial channel calibration for the SRM and CDBEM noble gas detectors is performed using dards traceable to NIST.
5.4.1        Technical Specifications tain material in this section provides information that is used in the technical specifications.
includes limiting conditions for operation, setpoints, design features, and means for omplishing surveillances. In addition, significant material is also applicable to, and may be renced by, the bases that are described in the technical specifications.
6        CONCLUSION iation monitoring within the SHINE facility is performed by multiple radiation monitoring cesses. The radiation monitoring supports facility control room operations, provides rmation and alarms for personnel within the facility, provides input to safety-related control tems to actuate safety systems, and provides the ability to monitor radioactive releases to the ironment.
radiation monitoring systems and equipment are designed to applicable SHINE facility ign criteria and applicable quality standards to support reliable operation in performing the ation monitoring functions.
NE Medical Technologies                    7.7-13                                          Rev. 4
 
Table 7.7 Safety-Related Process Radiation Monitors (Sheet 1 of 4)
Total  Minimum Monitored    Monitored        Unit                      Available Required      Operability t  Material    Location      Location        Function    Channels  Channels    Requirements Detect elevated RVZ1                                                          Whenever PVVS, radiation levels supercell                                                        VTS, or N2PS is Fission                  Supercell  from process area 1 (PVVS)                                    3        2    operating and hot cell products                    exterior  vessel exhaust                                                      isolation dampers are ventilation cell ventilation                                                          not closed (input to ESFAS)
Whenever target RVZ1 Detect elevated                            solution or supercell radiation levels                    radioisotope products Fission      area 2      Supercell from extraction      2        2    are present in the hot products  (extraction A)  exterior cell A (input to                        cell and hot cell exhaust ESFAS)                              isolation dampers are ventilation not closed RVZ1 Detect elevated supercell radiation levels Fission      area 3      Supercell from purification    2        2 products  (purification A)  exterior cell A (input to exhaust ESFAS) ventilation RVZ1                                                              Whenever Detect elevated supercell                                                    radioisotope products radiation levels Fission      area 4      Supercell                                      are present in the hot from packaging        2        2 products  (packaging 1)    exterior                                          cell and hot cell cell 1 (input to exhaust                                                      isolation dampers are ESFAS) ventilation                                                          not closed RVZ1 Detect elevated supercell radiation levels Fission      area 5      Supercell from purification    2        2 products  (purification B)  exterior cell B (input to exhaust ESFAS) ventilation Whenever target RVZ1 Detect elevated                            solution or supercell radiation levels                    radioisotope products Fission      area 6      Supercell from extraction      2        2    are present in the hot products  (extraction B)  exterior cell B (input to                        cell and hot cell exhaust ESFAS)                              isolation dampers are ventilation not closed Whenever target RVZ1 Detect elevated                            solution or supercell radiation levels                    radioisotope products Fission      area 7      Supercell from extraction      2        2    are present in the hot products  (extraction C)  exterior cell C (input to                        cell and hot cell exhaust ESFAS)                              isolation dampers are ventilation not closed NE Medical Technologies                      7.7-14                                          Rev. 4
 
Total  Minimum Monitored    Monitored        Unit                    Available Required      Operability t  Material    Location      Location        Function    Channels  Channels    Requirements RVZ1 Detect elevated supercell radiation levels Fission      area 8      Supercell from purification    2        2 products  (purification C)  exterior cell C (input to exhaust ESFAS) ventilation RVZ1                                                              Whenever Detect elevated supercell                                                    radioisotope products radiation levels Fission      area 9      Supercell                                      are present in the hot from packaging        2        2 products  (packaging 2)    exterior                                        cell and hot cell cell 2 (input to exhaust                                                    isolation dampers are ESFAS) ventilation                                                        not closed Detect elevated RVZ1 radiation levels supercell Fission                  Supercell from iodine and area 10 (IXP)                                  2        2 products                    exterior xenon exhaust purification cell ventilation (input to ESFAS)
Detect elevated Mezzanine radiation levels Fission    RVZ1 RCA        (RPF from RVZ1 RCA        3        2 products      exhaust      general exhaust (input to                      Whenever facility area)
ESFAS)                                operations are not secured or RVZ Detect elevated                      isolation dampers are Mezzanine radiation levels                            not closed Fission    RVZ2 RCA        (RPF from RVZ2 RCA        3        2 products      exhaust      general exhaust (input to area)
ESFAS)
Detect elevated tritium concentration in                      Whenever tritium is TPS tritium                                present in the TPS Tritium  confinement A    TPS room                        2        2 purification                            confinement in atmosphere system                                  gaseous form confinement (input to ESFAS)
Detect elevated tritium concentration in                      Whenever tritium is TPS tritium                                present in the TPS Tritium  confinement B    TPS room                        2        2 purification                            confinement in atmosphere system                                  gaseous form confinement (input to ESFAS)
NE Medical Technologies                      7.7-15                                        Rev. 4
 
Total  Minimum Monitored  Monitored          Unit                    Available Required      Operability t    Material    Location        Location      Function    Channels  Channels    Requirements Detect elevated tritium concentration in                      Whenever tritium is TPS tritium                              present in the TPS Tritium confinement C      TPS room                      2        2 purification                            confinement in atmosphere system                                  gaseous form confinement (input to ESFAS)
Detect elevated Whenever tritium is tritium present in the TPS concentration in exhaust to RVZ1e in TPS exhaust                tritium Tritium                    TPS room                      3        2      gaseous form and to facility stack            purification TPS confinement system exhaust isolation devices are to RVZ1e (input not closed to ESFAS)
RVZ1e IU                    Detect elevated cell 1 primary              radiation levels closed loop                  from IU 1 PCLS Fission                      Cooling                                                Modes 1 cooling system              expansion tank        3        2 products                      room                                                  through 4 (PCLS)                      exhaust (input to expansion                    TRPS) tank exhaust Detect elevated RVZ1e IU                    radiation levels Fission    cell 2 PCLS      Cooling    from IU 2 PCLS                              Modes 1 3        2 products    expansion        room      expansion tank                            through 4 tank exhaust                exhaust (input to TRPS)
Detect elevated RVZ1e IU                    radiation levels Fission    cell 3 PCLS      Cooling    from IU 3 PCLS                              Modes 1 3        2 products    expansion        room      expansion tank                            through 4 tank exhaust                exhaust (input to TRPS)
Detect elevated RVZ1e IU                    radiation levels Fission    cell 4 PCLS      Cooling    from IU 4 PCLS                              Modes 1 3        2 products    expansion        room      expansion tank                            through 4 tank exhaust                exhaust (input to TRPS)
Detect elevated RVZ1e IU                    radiation levels Fission    cell 5 PCLS      Cooling    from IU 5 PCLS                              Modes 1 3        2 products    expansion        room      expansion tank                            through 4 tank exhaust                exhaust (input to TRPS)
NE Medical Technologies                        7.7-16                                        Rev. 4
 
Total  Minimum Monitored  Monitored      Unit                    Available Required      Operability t    Material    Location    Location    Function      Channels  Channels    Requirements Detect elevated RVZ1e IU                radiation levels Fission    cell 6 PCLS  Cooling    from IU 6 PCLS                              Modes 1 3        2 products    expansion    room      expansion tank                            through 4 tank exhaust            exhaust (input to TRPS)
Detect elevated RVZ1e IU                radiation levels Fission    cell 7 PCLS  Cooling    from IU 7 PCLS                              Modes 1 3        2 products    expansion    room      expansion tank                            through 4 tank exhaust            exhaust (input to TRPS)
Detect elevated RVZ1e IU                radiation levels Fission    cell 8 PCLS  Cooling    from IU 8 PCLS                              Modes 1 3        2 products    expansion    room      expansion tank                            through 4 tank exhaust            exhaust (input to TRPS)
Detect elevated Whenever target radiation levels MEPS heating                                                      solution or Fission                  Supercell  from section A of loop                                          2        2    radioisotope products products                exterior  the hot water extraction A                                                are present in the hot loop (input to cell ESFAS)
Detect elevated Whenever target radiation levels MEPS heating                                                      solution or Fission                  Supercell  from section B of loop                                          2        2    radioisotope products products                exterior  the hot water extraction B                                                are present in the hot loop (input to cell ESFAS)
Detect elevated Whenever target radiation levels MEPS heating                                                      solution or Fission                  Supercell  from section C of loop                                          2        2    radioisotope products products                exterior  the hot water extraction C                                                are present in the hot loop (input to cell ESFAS)
NE Medical Technologies                  7.7-17                                          Rev. 4
 
Table 7.7 Radiation Area Monitor Locations Unit                          Function                              Location ea Monitor 1      Alert supercell operators of high radiation  Near supercell, ground levels                                        floor ea Monitor 2      Alert personnel of high radiation levels from North end of RPF tank tank vaults near the north-west RPF          vaults, ground floor emergency exit ea Monitor 3      Alert personnel of high radiation levels from South end of RPF tank tank vaults near the main RPF exit            vaults, ground floor ea Monitor 4      Alert waste cell operators of high radiation  Near waste enclosure, levels                                        ground floor ea Monitor 5      Alert personnel of high radiation levels from North end of main IF north off-gas or cooling rooms near the      corridor, ground floor north-east IF emergency exit ea Monitor 6      Alert personnel of high radiation levels from South end of main IF south off-gas, cooling rooms, and NDAS        corridor, ground floor service cell near the IF overhead doors ea Monitor 7      Alert personnel of high radiation levels from North end of IU vaults, top north IU cells                                of vault elevation ea Monitor 8      Alert personnel of high radiation levels from South end of IU vaults, top south IU cells                                of vault elevation ea Monitor 9      Alert personnel of high radiation levels from TPS room roof elevation the NDAS service cell ea Monitor 10    Alert personnel of high radiation levels from Safety-related area, facility filter banks                                  mezzanine NE Medical Technologies                7.7-18                                        Rev. 4
 
Table 7.7 Continuous Airborne Monitor Locations Unit                        Function                                  Location borne    Alert supercell operators of high contamination    Near supercell, ground floor nitor 1  levels borne    Alert personnel of high contamination levels      North end of RPF tank vaults, nitor 2  from tank vaults near the north-west RPF          ground floor emergency exit borne    Alert personnel of high contamination levels      South end of RPF tank vaults, nitor 3  from tank vaults near the main RPF exit            ground floor borne    Alert waste cell operators of high contamination Near waste enclosure, ground nitor 4  levels                                            floor borne    Alert personnel of high contamination levels      North end of main IF corridor, nitor 5  from north off-gas or cooling rooms near the      ground floor north-east IF emergency exit borne    Alert personnel of high contamination levels      South end of main IF corridor, nitor 6  from south off-gas or cooling rooms near the IF    ground floor overhead doors borne    Alert personnel of high contamination levels      Safety-related area nitor 7  from filter banks                                  mezzanine, facility mezzanine borne    Alert laboratory personnel of high contamination North laboratory, ground floor nitor 8  levels borne    Alert laboratory personnel of high contamination South laboratory, ground floor nitor 9  levels borne    Alert personnel of high contamination levels      Target solution preparation nitor 10 from target solution preparation activities        room, ground floor borne    Alert personnel of high contamination levels      Uranium storage room, ground nitor 11 from target solution preparation activities        floor tium      Alert personnel of high tritium levels from the    TPS room, ground floor nitor 12 TPS glovebox tium      Alert personnel of high tritium levels in the main Main IF corridor, ground floor nitor 13 IF corridor NE Medical Technologies                    7.7-19                                      Rev. 4
 
NE Medical Technologies 7.7-20 Rev. 4 1        SYSTEM DESCRIPTION neutron flux detection system (NFDS) performs the task of monitoring and indicating the tron flux to determine the multiplication factor and power level during filling of the target tion vessel (TSV) and irradiating the target solution. The signal from the detectors is smitted to the pre-amplifiers where the signal is amplified and filtering for noise reduction is ormed. The outputs of each pre-amplifier are used to perform measurement of the neutron signal, signal processing, indication, and interfacing with other systems. The NFDS rfaces with the TSV reactivity protection system (TRPS) for safety-related interfaces and nitoring and indication, which will then be transmitted to the process integrated control tem (PICS).
NFDS monitors variables important to the safety functions of the irradiation unit (IU) to vide input to the TRPS to perform its safety functions.
NFDS provides continuous indication of the neutron flux during operation, from filling ugh maximum power during irradiation. To cover the entire range of neutron flux levels, there three different ranges provided from the NFDS: source range, wide range, and power range.
rce range covers the low levels expected while the TSV is being filled while power range ers the higher flux levels anticipated while the neutron driver is on and irradiating. To cover gap between the source and power ranges, the wide range monitors the flux levels between source and power range with a minimum two decade overlap with the high end of the source ge and the low end of the power range.
NFDS is a three-division system with three detectors positioned around the subcritical embly support structure (SASS) at approximately 120-degree intervals to the TSV. Each sion of the NFDS consists of a watertight detector located in the light water pool, a pre-plifier mounted in the radioisotope production facility (RPF), and a signal processing unit de the facility control room. The three watertight detectors located in a light water pool are ported using brackets attached to the outer shell of the SASS. These brackets serve to locate flux detectors in a fixed location relative to the TSV, ensuring flux profiles are measured sistently such that the sensitivity in the source range reliably indicates the neutron flux levels ugh the entire range of filling with the target solution.
2        DESIGN CRITERIA SHINE facility design criteria applicable to the NFDS are as stated in Chapter 3, Table 3.1-1.
facility design criteria applicable to the NFDS, and the NFDS system design criteria, are ressed in this section.
2.1          SHINE Facility Design Criteria NE facility design criteria 13 through 19 apply to the NFDS.
2.1.1        Instrumentation and Controls SHINE Design Criterion 13 - Instrumentation is provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated transients, and for NE Medical Technologies                      7.8-1                                        Rev. 3
 
primary confinement and its associated systems, and the process confinement boundary and its associated systems. Appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.
NFDS provides continuous indication of the neutron flux during operation, from filling ugh maximum power during irradiation (Subsection 7.8.1). The neutron flux detector oints bound normal operations and accident conditions and provide margin to analytical ts (Subsection 7.8.4.3). Setpoints are established based on a documented methodology and ounts for uncertainties in each instrument channel (Subsection 7.8.2.2.5). The NFDS ports maintenance and testing to ensure operability as required by the technical cifications (Subsection 7.8.3.10).
2.1.2        Protection System Functions SHINE Design Criterion 14 - The protection systems are designed to:
: 1) initiate, automatically, the operation of appropriate systems to ensure that specified acceptable target solution design limits are not exceeded as a result of anticipated transients; and
: 2) sense accident conditions and to initiate the operation of safety-related systems and components.
tron flux detector setpoints bound normal operations and accident conditions and provide gin to analytical limits (Subsection 7.8.4.3). Upon reaching the neutron flux signal setpoints ble 7.4-1), automatic safety actuations are initiated by the TRPS, as described in section 7.4.4.1.
2.1.3        Protection System Reliability and Testability SHINE Design Criterion 15 - The protection systems are designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.
Redundancy and independence designed into the protection systems are sufficient to ensure that:
: 1) no single failure results in loss of the protection function, and
: 2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.
The protection systems are designed to permit periodic testing, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection. Interfacing systems with the NFDS are downstream of the DS such that a failure of an interfacing nonsafety system will not impact the NFDS bsection 7.8.3.3 and Figure 7.4-1). The NFDS supports maintenance and testing to ensure rability as required by the technical specifications. The NFDS is designed to allow operators NE Medical Technologies                      7.8-2                                      Rev. 3
 
sions interface with TRPS, which has been analyzed for single failure in accordance with E Standard 379-2000 (IEEE, 2000) for all inputs, including NFDS.
2.1.4        Protection System Independence SHINE Design Criterion 16 - The protection systems are designed to ensure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function or are demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, are used to the extent practical to prevent loss of the protection function.
NFDS is qualified for operation during and after a seismic design basis event using the ance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.8). The NFDS components located in the RPF and the irradiation facility (IF) and are protected from seismic events, ado wind, tornado missile, and external flooding (Subsection 7.8.3.8). Hurricanes, tsunamis, seiches are not credible events at the SHINE facility (Subsections 2.4.5.1, 2.4.2.7, and 5.2). Physical and electrical independence (Subsection 7.8.3.4), redundancy bsection 7.8.3.3), equipment qualification (Subsection 7.8.3.7), and quality in design bsection 7.8.3.11) are applied in the NFDS design to prevent loss of the protective function.
2.1.5        Protection System Failure Modes SHINE Design Criterion 17 - The protection systems are designed to fail into a safe state if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments are experienced.
NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an DS channel presents to TRPS as zero current on the analog outputs to allow TRPS to treat condition as a positive trip determination . The interaction between NFDS and TRPS is wn in Figure 7.4-1 (Subsection 7.8.3.5).
2.1.6        Separation of Protection and Control Systems SHINE Design Criterion 18 - The protection system is separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems is limited to assure that safety is not significantly impaired.
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). Communications from the NFDS to the PS and PICS (via TRPS) are continuous through isolated outputs that only allow the data to ransmitted out of the system so that no failure from an interfacing system can affect the tions of the NFDS (Subsection 7.8.3.2).
NE Medical Technologies                    7.8-3                                        Rev. 3
 
SHINE Design Criterion 19 - The protection systems are designed to ensure an extremely high probability of accomplishing their safety functions in the event of anticipated transients.
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are sically and electrically independent of each other (Subsection 7.8.3.4) and the NFDS ipment is qualified for normal and transient conditions (Subsections 7.8.3.6 and 7.8.3.7).
2.2        NFDS System Design Criteria 2.2.1      General Instrumentation and Control NFDS Criterion 1 - The range of operation of detector channels for the NFDS shall be sufficient to cover the expected range of variation of monitored neutron flux during normal and transient operation.
neutron flux detector setpoints bound normal operations and accident conditions and vide margin to analytical limits (Subsection 7.8.4.3).
NFDS Criterion 2 - The NFDS shall give continuous indication of the neutron flux from subcritical source multiplication level through licensed maximum power range. The continuous indication shall ensure at least two decades of overlap in indication is maintained while observation is transferred from one channel to another.
NFDS provides continuous indication of the neutron flux from zero counts per second to at t 250 percent power with two decades of overlap (Subsection 7.8.3.1).
NFDS Criterion 3 - The NFDS power range channels shall provide reliable TSV power level while the source range channel provides count rate information from detectors that directly monitor the neutron flux.
NFDS power range provides a signal proportional to TSV power level from 0 to 125 percent he licensed power limit. The source range provides a current signal proportional to count rate all expected startup count rates (Subsection 7.8.3.1).
NFDS Criterion 4 - The NFDS log power range channel (i.e., wide range channel) and a linear flux monitoring channel (i.e., power range channel) shall accurately sense neutrons during irradiation, even in the presence of intense high gamma radiation.
h NFDS division includes an ionization chamber detector and a Boron Trifluoride (BF3) ector pair. These detector types are primarily sensitive to thermal neutrons.
NFDS Criterion 5 - The NFDS shall provide redundant TSV power level indication through the licensed maximum power range.
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The wide range neutron flux monitors cent power up to 250 percent of the licensed power limit (Subsection 7.8.3.1.3). The power NE Medical Technologies                    7.8-4                                        Rev. 3
 
NFDS Criterion 6 - The location and sensitivity of at least one NFDS detector in the source range channel, along with the location and emission rate of the subcritical multiplication source, shall be designed to ensure that changes in reactivity will be reliably indicated even with the TSV shut down.
positioning of the NFDS source range detectors, and the location, and emission rate of the critical multiplication source, is designed so that all three channels are on scale throughout
: g. This includes while the TSV is empty of solution. NFDS source range signal increases with easing target solution volume, and in this way, increasing reactivity will always produce an ease in count rate.
NFDS Criterion 7 - The NFDS shall have at least one detector in the power range channel to provide reliable readings to a predetermined power level above the licensed maximum power level.
wide range neutron flux monitors percent power up to 250 percent of the licensed power limit bsection 7.8.3.1.3). The power range neutron flux signal has a range of 0 percent to percent of the licensed power limit (Subsection 7.8.3.1.2).
NFDS Criterion 8 - The NFDS shall be separated from the PICS to the extent that any removal of a component or channel common to both the NFDS and the PICS preserves the reliability, redundancy, and independence of the NFDS.
mmunications from the NFDS to the TRPS and PICS (via TRPS) are continuous through ated outputs that only allow the data to be transmitted out of the system so that no failure from nterfacing system can affect the functions of the NFDS (Subsection 7.8.3.2).
NFDS Criterion 9 - The NFDS detectors shall be qualified for continuous submerged operation within the light water pool. The NFDS detector housings shall be watertight and supported by a sleeve structure, mounted to the SASS, at specific locations surrounding the SASS.
NFDS detectors are housed in a watertight assembly qualified for submergence to a depth p to 16 feet (Subsection 7.8.3.7). The detector housings are supported using brackets ched to the outer shell of the SASS (Subsection 7.8.1). The detectors are installed roximately 120 degrees equidistant around the SASS in relation to the target solution vessel bsection 7.8.3.4).
NFDS Criterion 10 - The timing of NFDS communications shall be deterministic.
timing of NFDS communications is deterministic.
2.2.2        Single Failure NFDS Criterion 11 - The NFDS shall be designed to perform its protective functions after experiencing a single random active failure in nonsafety control systems or in the NFDS, and NE Medical Technologies                      7.8-5                                        Rev. 3
 
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection. Interfacing systems with the NFDS are downstream of the DS such that a failure of an interfacing nonsafety system will not impact the NFDS bsection 7.8.3.3 and Figure 7.4-1). Communications from the NFDS to the TRPS and PICS TRPS) are continuous through isolated outputs that only allow the data to be transmitted out he system so that no failure from an interfacing system can affect the functions of the NFDS bsection 7.8.3.2).
NFDS Criterion 12 - The NFDS shall be designed such that no single failure can cause the failure of more than one redundant component.
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits for single failure protection (Subsection 7.8.3.3). The three divisions of the NFDS are sically and electrically independent of each other (Subsection 7.8.3.4).
2.2.3        Independence NFDS Criterion 13 - Physical separation and electrical isolation shall be used to maintain the independence of NFDS circuits and equipment among redundant safety divisions or with nonsafety systems so that the safety functions required during and following any maximum hypothetical accident or postulated accident can be accomplished.
three divisions of the NFDS are physically and electrically independent of each other bsection 7.8.3.4). The NFDS detector cables are routed to the TRPS electronics in physically arated electronics enclosures (Subsection 7.8.3.4) in accordance with IEEE ndard 384-2008 (IEEE, 2008) (Subsection 7.8.3.11). Interfacing systems with the NFDS are nstream of the NFDS such that a failure of an interfacing nonsafety system will not impact NFDS (Subsection 7.8.3.3).
NFDS Criterion 14 - The NFDS shall be designed such that no communication-within a single safety channel, between safety channels, and between safety and nonsafety systems-adversely affects the performance of required safety functions.
three divisions of the NFDS are physically and electrically independent of each other bsection 7.8.3.4). Interfacing systems with the NFDS are downstream of the NFDS such that ilure of an interfacing nonsafety system will not impact the NFDS (Subsection 7.8.3.3).
mmunications from the NFDS to the TRPS and PICS (via TRPS are continuous through ated outputs. The output isolation devices only allow for the data to be transmitted out of the tem so that no failure from an interfacing system can affect the functions of the NFDS bsection 7.8.3.2).
2.2.4        Fail Safe NFDS Criterion 15 - The NFDS and associated components shall be designed to assume a safe state on loss of electrical power.
NE Medical Technologies                      7.8-6                                      Rev. 3
 
site power. The NFDS is designed so that a failure due to loss of power to the NFDS or a oval of an NFDS channel interacts the same with the TRPS as if there was a positive trip ermination output to the TRPS. The interaction between NFDS and TRPS is shown in ure 7.4-1 (Subsection 7.8.3.5).
NFDS Criterion 16 - The NFDS shall not be designed to fail or operate in a mode that could prevent the TRPS from performing its intended safety function. The design of the NFDS shall consider:
: 1) The effect of NFDS on accidents
: 2) The effects of NFDS failures
: 3) The effects of NFDS failures caused by accidents.
The failure analyses shall cover hardware and software failures associated with the NFDS.
NFDS utilizes a fault-tolerant, triple redundant architecture. This design identifies and pensates for failed system elements. Because of the triple redundant architecture of the DS platform, failure mechanisms that affect a single function have no effect on plant ration.
2.2.5        Setpoints NFDS Criterion 17 - Neutron flux setpoints for an actuation of the NFDS shall be based on a documented analysis methodology that identifies assumptions and accounts for uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel. The setpoint analysis parameters and assumptions shall be consistent with the safety analysis, system design basis, technical specifications, facility design, and expected maintenance practices.
points in the NFDS are based on a documented methodology that identifies each of the umptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsection 7.2.1.
NFDS Criterion 18 - Adequate margin shall exist between setpoints and safety limits so that the TRPS initiates protective actions before safety limits are exceeded.
points applicable to the NFDS are based on a documented methodology that identifies each he assumptions and accounts for the uncertainties in each instrument channel. The setpoint hodology is further described in Subsection 7.2.1.
NFDS Criterion 19 - The sensitivity of each NFDS sensor channel shall be commensurate with the precision and accuracy to which knowledge of the variable measured is required for the protective function.
source range neutron flux measurement supports filling of the IU cell prior to irradiation of target solution. The power range neutron flux measurement supports operations when the tron driver is operating and irradiating the target solution, and the wide range neutron flux asurement overlaps the source range and power range and is usable during both source and NE Medical Technologies                      7.8-7                                        Rev. 3
 
2.2.6      Equipment Qualification NFDS Criterion 20 - The effects of electromagnetic interference/radio-frequency interference (EMI/RFI) and power surges on the NFDS shall be adequately addressed.
k mounted NFDS equipment is tested to appropriate standards to show that the effects of I/RFI and power surges are adequately addressed (Subsection 7.8.3.7). The codes and dards applicable to the NFDS design are stated in Subsection 7.8.3.11.
2.2.7      Surveillance NFDS Criterion 21 - The NFDS shall provide the capability for calibration, inspection, and testing to validate the desired functionality of the NFDS.
NFDS supports testing and calibration to ensure operability as required by the technical cifications. The NFDS is designed to allow operators to remove portions of the NFDS from vice when not required for operation without impacting NFDS components specific to other IU s (Subsection 7.8.3.10).
NFDS Criterion 22 - Equipment in the NFDS (from the input circuitry to output actuation circuitry) shall be designed to allow testing, calibration, and inspection to ensure operability. If testing is required or can be performed as an option during operation, the NFDS shall retain the capability to accomplish its safety function while under test.
NFDS design supports testing and calibration to ensure operability as required by the nical specifications. The NFDS is designed to allow operators to remove portions of the DS from service when not required for operation without impacting NFDS components cific to other IU cells (Subsection 7.8.3.10).
NFDS Criterion 23 - Testing, calibration, and inspections of the NFDS shall be sufficient to confirm that surveillance test and self-test features address failure detection, self-test capabilities, and actions taken upon failure detection.
an all analog system, the only form of fault detection normally available is the source range sing and power range missing discrete signals provided to the PICS (Subsection 7.8.3.10).
NFDS Criterion 24 - The design of the NFDS and the justification for test intervals shall be consistent with the surveillance testing intervals as part of the facility technical specifications.
iting Conditions for Operation and Surveillance Requirements are established for the NFDS e technical specifications (Subsection 7.8.4.3). The NFDS design supports testing and bration to ensure operability as required by the technical specifications (Subsection 7.8.3.10).
2.2.8      Classification and Identification NFDS Criterion 25 - NFDS equipment shall be distinctively identified to indicate its safety classification and to associate equipment according to divisional or channel assignments.
NE Medical Technologies                      7.8-8                                          Rev. 3
 
2.2.9        Human Factors NFDS Criterion 26 - The NFDS shall be designed to provide the information necessary to support annunciation of the channel initiating a protective action to the operator.
DS input to TRPS safety functions are communicated to the PICS to alert the operators. The system architecture is shown in Figure 7.1-1.
2.2.10      Quality NFDS Criterion 27 - Controls over the design, fabrication, installation, and modification of the NFDS shall conform to the guidance of ANSI/ANS 15.8-1995 (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5 (USNRC, 2010).
SI/ANS 15.8-1995 (ANSI/ANS, 1995) is applied to the NFDS by the SHINE Quality Assurance gram (Subsection 7.8.3.11). The SHINE Quality Assurance Program controls activities ted to the system design, fabrication, installation, and modification.
NFDS Criterion 28 - The quality of the components and modules in the NFDS shall be commensurate with the importance of the safety function to be performed.
ustry codes and standards are applied to the design of the NFDS to ensure quality in the ign of this safety-related system (Subsection 7.8.3.11). The NFDS is also designed for the mal and transient operating environments, as described in Subsections 7.8.3.6 and 7.8.3.7.
3      DESIGN BASES 3.1          Design Bases Functions NFDS measures the neutron flux in the TSV over three separate ranges: source range, er range, and wide range.
3.1.1      Source Range source range measures low flux levels common to what would be expected during the filling he IU cell prior to irradiation of the target solution.
NFDS provides TRPS a count rate signal for TRPS to perform a trip determination upon ching the source range setpoint. The TRPS initiates an IU Cell Safety Actuation when two-of-three or more high source range neutron flux signals from NFDS are above their setpoint bsection 7.4.4).
NFDS transmits the following source range analog signal to the TRPS:
* NFDS source range NE Medical Technologies                      7.8-9                                    Rev. 3
* Increasing at 2.52 times the nominal flux at 95 percent volume of the critical fill height source range neutron flux signal has an accuracy of less than or equal to 2 percent of the full ar scale.
3.1.2        Power Range power range measures high flux levels in the ranges that are expected when the neutron er is operating and irradiating the target solution.
NFDS transmits the following power range analog signal to the TRPS:
* NFDS power range power range neutron flux signal is input to the safety-related trip determination by the TRPS.
TRPS initiates a Driver Dropout on low power range neutron flux, as described in section 7.4.4 and initiates an IU Cell Safety Actuation on high (power range) time-averaged tron flux, as described in Subsection 7.4.4.
power range neutron flux signal has a range of 0 percent to 125 percent of the licensed er limit and has an accuracy of less than or equal to 1 percent of the full linear scale.
3.1.3        Wide Range wide range neutron flux connects the gap between the source range and the power range overlap and is usable during both source and power range levels. The wide range neutron monitors percent power up to 250 percent of the licensed power limit.
NFDS transmits the following wide range analog signals to the TRPS:
* NFDS wide range NFDS wide range neutron flux signal is input to the safety-related trip determination by the PS. The TRPS initiates an IU Cell Safety Actuation on high wide range neutron flux, as cribed in Subsection 7.4.4.
wide range neutron flux signal has an accuracy of less than or equal to 1 percent of the full rithmic scale.
3.2          Simplicity NFDS is an analog system with no digital communications for simplicity. Communications the NFDS to the TRPS and PICS (via TRPS) are continuous through isolated outputs. The put isolation devices only allow for the data to be transmitted out of the system so that no re from an interfacing system can affect the functions of the NFDS.
NE Medical Technologies                    7.8-10                                          Rev. 3
 
NFDS is comprised of three redundant divisions of detectors, preamplifiers, and processing uits. A single failure of any one of the divisions will not affect the functionality of the other two undant divisions ensuring the required safety functions perform as designed during a design is event. Interfacing systems with the NFDS are downstream of the NFDS such that a failure n interfacing nonsafety system will not impact the NFDS.
3.4          Independence three divisions of the NFDS are physically and electrically independent of each other.
ectors are installed approximately 120 degrees equidistant around the SASS in relation to the et solution vessel. The detector cables are routed back to the TRPS electronics in physically arated electronics enclosures.
h division of the NFDS is capable of monitoring the neutron flux levels in the detector, reading amplifying the levels in the preamplifier, and processing the measurement readings within h division independently without aid of another NFDS division or external safety or nonsafety tem.
3.5          Loss of External Power NFDS is supplied power from the UPSS upon a loss of off-site power. The UPSS battery kup supplies power to the NFDS for a minimum of 10 minutes following a loss of off-site er.
NFDS is designed so that a failure due to loss of power to the NFDS or a removal of an DS channel interacts the same with the TRPS as if there was a positive trip determination in PS. The interaction between NFDS and TRPS is shown in Figure 7.4-1.
3.6          Operating Conditions NFDS control and logic functions are located in the RPF and IF where the environment is and not exposed to the irradiation process. The preamplifiers are located in the RPF where rating conditions are a mild operating environment. The detectors are located within the IU where they are exposed to high radiation levels (approximately 3.5E+05 rad/hour) and are lified to survive that environment.
normal and transient environmental conditions present in areas where NFDS is located are vided in Table 7.2-2 through Table 7.2-4. The main production facility heating, ventilation, and conditioning (HVAC) systems are relied upon to maintain the temperature and humidity ameters in these areas. The main production facility HVAC systems are described in tion 9a2.1.
ing normal operation, the NFDS equipment will operate in the applicable normal radiation ironments identified in Table 7.2-1 for up to 20 years, and will be replaced at a frequency icient such that the radiation qualification of the affected components is not exceeded.
NE Medical Technologies                    7.8-11                                            Rev. 3
 
NFDS detectors are housed in a watertight assembly qualified for submergence to a depth o 16 feet.
DS rack mounted equipment is installed in a mild operating environment and is designed to et the normal and transient environmental conditions described in Subsection 7.8.3.6. Rack unted NFDS equipment is tested to appropriate standards to show that the effects of EMI/RFI power surges are adequately addressed. Appropriate grounding of the NFDS is performed in ordance with Section 5.2.1 of IEEE Standard 1050-2004 (IEEE, 2004b).
3.8          Natural Phenomena NFDS is qualified for operation during and after a seismic design basis event. The NFDS is lified using the guidance in IEEE Standard 344-2013 (IEEE, 2013) (Subsection 7.8.3.11).
NFDS components are located in the RPF and the IF. The RPF and IF are classified as smic Class I structures (Section 3.4) that provide protection from tornado and tornado siles (Subsection 3.2.2.3). The main production facility is protected from an external flood bsection 3.3.1.1.1).
3.9          Human Factors NFDS provides the following signals to the TRPS to transmit to the PICS for display to the rator:
* Source range neutron flux
* Wide range neutron flux
* Power range neutron flux rator display criteria and design are addressed in Section 7.6.
3.10        Maintenance and Testing NFDS supports testing and calibration to ensure operability as required by the technical cifications. The NFDS is designed to allow operators to remove portions of the NFDS from vice when not required for operation without impacting NFDS components specific to other IU
: s. Fault detection for the source range missing and power range missing discrete signals is vided to the PICS (via TRPS).
3.11        Codes and Standards following codes and standards are applied to the NFDS design:
: 1) Section 8 of IEEE Standard 344-2013, IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating Stations (IEEE, 2013); invoked as guidance to meet SHINE Design Criterion 16.
NE Medical Technologies                    7.8-12                                        Rev. 3
 
Design Criterion 15, Protection system reliability and testability.
: 3) IEEE Standard 384-2008, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits (IEEE, 2008); invoked for separation of safety-related and nonsafety-related cables and raceways, as described in Subsection 8a2.1.3 and Subsection 8a2.1.5.
: 4) Section 5.2.1 of IEEE Standard 1050-2004, IEEE Guide for Instrumentation and Control Equipment Grounding in Generating Stations (IEEE, 2004b); invoked as guidance to support electromagnetic compatibility qualification for digital I&C equipment.
: 5) The guidance of ANSI/ANS 15.8-1995, Quality Assurance Program Requirements for Research Reactors (R2013) (ANSI/ANS, 1995), as endorsed by Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors (USNRC, 2010), is applied as part of the SHINE Quality Assurance Program for complying with the programmatic requirements of 10 CFR 50.34(b)(6)(ii).
4      OPERATION AND PERFORMANCE NFDS supports safe and reliable operation of the SHINE facility and prevents a single failure defeating the intended NFDS functions.
4.1          Monitored Variables NFDS measures the flux over three separate ranges, source range, wide range, and power ge.
source range measures low flux levels common to what would be expected during the filling e prior to irradiation of the target solution.
power range measures high flux levels in the ranges that are expected when the neutron er is operating and irradiating the target solution.
wide range connects the gap between the source range and the power range with overlap is usable during both source and power range levels.
he source range, individual pulses are created as a result of neutron interaction with the ector and are recorded by the NFDS. The range of the source range measurement counts es up to 1.0E+05 counts per second (cps). The inverse of the count rate can also be used to mate the critical fill level using the 1/M methodology.
he power range, the neutron flux is measured in terms of the design power levels of the TSV.
range of measurement of the power range is indicated as 0 percent to 125 percent.
wide range measurement monitors the power level in a logarithmic scale over 10 decades 2.5E-08 percent up to 250 percent covering the irradiation cycle both during deuterium-terium reactions and deuterium-tritium reactions.
NE Medical Technologies                      7.8-13                                    Rev. 3
 
NFDS provides the following analog signals to the TRPS:
* NFDS source range
* NFDS wide range
* NFDS power range NFDS also provides a source range missing and power range missing signal to the PICS TRPS) for use as an alarm to the operator in alerting that the NFDS is not operating properly.
TRPS transmits the analog signals as nonsafety-related signals to the PICS to display for rator use when monitoring conditions in the IU cells.
4.3        Technical Specifications and Surveillance iting Conditions for Operation and Surveillance Requirements are established for the NFDS e technical specifications. The neutron flux detector setpoints bound normal operations and ident conditions and provide margin to analytical limits.
5      CONCLUSION NFDS monitors neutron flux levels inside the target solution vessel to support safe operation he SHINE facility. The system design includes a high source range neutron flux trip ermination and neutron flux variables that are input to the TRPS for safety actuations. The DS also transmits signals to TRPS (Section 7.4) that are transmitted by TRPS as nonsafety-ted neutron flux values to the PICS for display to the operators.
system design incorporates independence and redundancy to ensure no single failure vents the NFDS from fulfilling its intended safety functions.
NE Medical Technologies                    7.8-14                                      Rev. 3
 
SI, 1999. Sampling and Monitoring Releases of Airborne Radioactive Substances from the cks and Ducts of Nuclear Facilities, ANSI N13.1-1999, American National Standards Institute, 9.
SI/ANS, 1995. Quality Assurance Program Requirements for Research Reactors, SI/ANS 15.8-1995 (R2013), American National Standards Institute/American Nuclear Society, 5.
E, 2000. IEEE Standard Application of Single-Failure Criterion to Nuclear Power Generating tion Safety Systems, IEEE 379-2000, Institute of Electrical and Electronics Engineers, 2000.
E, 2003a. IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power erating Stations, IEEE 7-4.3.2-2003, Institute of Electrical and Electronics Engineers, 2003.
E, 2003b. IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating tions, IEEE 323-2003, Institute of Electrical and Electronics Engineers, 2003.
E, 2004a. IEEE Standard for Software Verification and Validation, IEEE 1012-2004, Institute lectrical and Electronics Engineers, 2004.
E, 2004b. IEEE Guide for Instrumentation and Control Equipment Grounding in Generating tions, IEEE 1050-2004, Institute of Electrical and Electronics Engineers, 2004.
E, 2008. IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, E 384-2008, Institute of Electrical and Electronics Engineers, 2008.
E, 2013. IEEE Standard for Seismic Qualification of Equipment for Nuclear Power Generating tions, IEEE 344-2013, Institute of Electrical and Electronics Engineers, 2013.
Scale, 2017. NuScale Power, LLC Submittal of the Approved Version of NuScale Topical ort TR-1015-18653, Design of the Highly Integrated Protection System Platform, Revision 2 C No. RQ6005), NuScale Power, LLC, September 13, 2017 (ML17256A892).
NRC, 1994. Method for Performing Diversity and Defense-in-Depth Analyses of the Reactor tection Systems, NUREG/CR-6303, U.S Nuclear Regulatory Commission, December 1994.
NRC, 2010. Quality Assurance Program Requirements for Research and Test Reactors, ulatory Guide 2.5, Revision 1, U.S. Nuclear Regulatory Commission, June 2010.
NRC, 2017. Safety Evaluation by the Office of New Reactors, Licensing Topical Report
) 1015-18653-P (Revision 2), Design of the Highly Integrated Protection System Platform, cale Power, LLC, U.S. Nuclear Regulatory Commission, May 2017.
NE Medical Technologies                    7.9-1                                        Rev. 2}}

Latest revision as of 18:47, 18 November 2024

Shine Technologies, LLC, Application for Operating License Supplement 14, Revision to Final Safety Analysis Report, Chapter 7, Instrumentation and Control System
ML22034A621
Person / Time
Site: SHINE Medical Technologies
Issue date: 01/26/2022
From:
SHINE Technologies, SHINE Health. Illuminated
To:
Office of Nuclear Reactor Regulation
Shared Package
ML22034A612 List:
References
2022-SMT-0007
Download: ML22034A621 (276)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML22034A621&oldid=3735667"