ML21252A753

Shine Medical Technologies, LLC - Request for Additional Information Related to Instrumentation and Control Systems

ML21252A753
Person / Time
Site:	SHINE Medical Technologies
Issue date:	09/29/2021
From:	Steven Lynch NRC/NRR/DANU/UNPL
To:	Piefer G SHINE Medical Technologies
Lynch S
References
EPID L-2019-NEW-0004
Download: ML21252A753 (21)

Text

September 27, 2021 Dr. Gregory Piefer, Ph. D.

Chief Executive Officer SHINE Medical Technologies, LLC 101 East Milwaukee Street, Suite 600 Janesville, WI 53545

SUBJECT:

SHINE MEDICAL TECHNOLOGIES, LLC - REQUEST FOR ADDITIONAL INFORMATION RELATED TO INSTRUMENTATION AND CONTROL SYSTEMS (EPID NO. L-2019-NEW-0004)

Dear Dr. Piefer:

By letter dated July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ADAMS Accession No. ML19337A275), March 27, 2020 (ADAMS Accession No. ML20105A295), August 28, 2020 (ADAMS Accession No. ML20255A027),

November 13, 2020 (ADAMS Accession No. ML20325A026), December 10, 2020 (ADAMS Package Accession No. ML20357A084), December 15, 2020 (ADAMS Package Accession No. ML21011A264), and March 23, 2021 (ADAMS Accession No. ML21095A235), SHINE Medical Technologies, LLC (SHINE) submitted to the U.S. Nuclear Regulatory Commission (NRC) an operating license application for its proposed SHINE Medical Isotope Production Facility in accordance with the requirements contained in Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities.

During the NRC staffs review of SHINEs operating license application, questions have arisen for which additional information is needed. The enclosed request for additional information (RAI) identifies information needed for the NRC staff to continue its review of the SHINE final safety analysis report, submitted in connection with the operating license application, and prepare a safety evaluation report. The specific chapter of the SHINE operating license application covered by this RAI is Chapter 7, Instrumentation and Control Systems.

It is requested that SHINE provide responses to the enclosed RAI within 60 days from the date of this letter. To facilitate a timely and complete response to the enclosed RAI, the NRC staff is available to meet with SHINE to clarify the scope of information and level of detail expected to be included in the RAI response and corresponding final safety analysis report update. SHINE may coordinate the scheduling and agendas for any such meetings with the responsible project manager assigned to this project.

In accordance with 10 CFR 50.30(b), Oath or affirmation, SHINE must execute its response in a signed original document under oath or affirmation. The response must be submitted in accordance with 10 CFR 50.4, Written communications. Information included in the response that is considered sensitive or proprietary, that SHINE seeks to have withheld from the public, must be marked in accordance with 10 CFR 2.390, Public inspections, exemptions, requests

G. Piefer for withholding. Any information related to safeguards should be submitted in accordance with 10 CFR 73.21, Protection of Safeguards Information: Performance Requirements.

Following receipt of the additional information, the NRC staff will continue its evaluation of the subject chapters and technical areas of the SHINE operating license application.

As the NRC staff continues its review of SHINEs operating license application, additional RAIs for other chapters and technical areas may be developed. The NRC staff will transmit any further questions to SHINE under separate correspondence.

If SHINE has any questions, or needs additional time to respond to this request, please contact me at 301-415-1524, or by electronic mail at Steven.Lynch@nrc.gov.

Sincerely, Signed by Lynch, Steven on 09/27/21 Steven T. Lynch, Senior Project Manager Non-Power Production and Utilization Facility Licensing Branch Division of Advanced Reactors and Non-Power Production and Utilization Facilities Office of Nuclear Reactor Regulation Docket No. 50-608 Construction Permit No. CPMIF-001

Enclosure:

As stated cc: See next page

SHINE Medical Technologies, LLC Docket No. 50-608 cc:

Jeff Bartelme Licensing Manager SHINE Medical Technologies, LLC 101 East Milwaukee Street, Suite 600 Janesville, WI 53545 Nathan Schleifer General Counsel SHINE Medical Technologies, LLC 101 East Milwaukee Street, Suite 600 Janesville, WI 53545 Christopher Landers Director, Office of Conversion National Nuclear Security Administration, NA 23 U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585 Mark Paulson, Supervisor Radiation Protection Section Wisconsin Department of Health Services P.O. Box 2659 Madison, WI 53701-2659 Test, Research and Training Reactor Newsletter Attention: Amber Johnson Dept. of Materials Science and Engineering University of Maryland 4418 Stadium Drive College Park, MD 20742-2115 Mark Freitag City Manager P.O. Box 5005 Janesville, WI 53547-5005 Bill McCoy 1326 Putnam Avenue Janesville, WI 53546 Alfred Lembrich 541 Miller Avenue Janesville, WI 53548

ML21252A753 NRR-088 OFFICE NRR/DANU/PM NRR/DANU/LA NRR/DANU/BC NRR/DANU/DD (A) NRR/DANU/PM NAME SLynch NParker (SLent for) JBorromeo SAnderson SLynch DATE 9/10/2021 9/10/2021 9/13/2021 9/27/2021 9/27/2021 OFFICE OF NUCLEAR REACTOR REGULATION REQUEST FOR ADDITIONAL INFORMATION REGARDING OPERATING LICENSE APPLICATION FOR SHINE MEDICAL TECHNOLOGIES, LLC CONSTRUCTION PERMIT NO. CPMIF-001 SHINE MEDICAL ISOTOPE PRODUCTION FACILITY DOCKET NO. 50-608 By letter dated July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ADAMS Accession No. ML19337A275), March 27, 2020 (ADAMS Accession No. ML20105A295), August 28, 2020 (ADAMS Accession No. ML20255A027),

November 13, 2020 (ADAMS Accession No. ML20325A026), December 10, 2020 (ADAMS Package Accession No. ML20357A084), December 15, 2020 (ADAMS Package Accession No. ML21011A264), and March 23, 2021 (ADAMS Accession No. ML21095A235), SHINE Medical Technologies, LLC (SHINE) submitted to the U.S. Nuclear Regulatory Commission (NRC) an operating license application for its proposed SHINE Medical Isotope Production Facility in accordance with the requirements contained in Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities.

During the NRC staffs review of SHINEs operating license application, questions have arisen for which additional information is needed. The enclosed request for additional information (RAI) identifies information needed for the NRC staff to continue its review of the SHINE final safety analysis report (FSAR), submitted in connection with the operating license application, and prepare a safety evaluation report. The specific chapter of the SHINE operating license application covered by this RAI is Chapter 7, Instrumentation and Control Systems.

The SHINE facility includes a safety-related target solution vessel (TSV) reactivity protection system (TRPS) to protect and operate each irradiated unit (IU). The purpose of the TRPS is to monitor process variables and provide automatic initiating signals in response to off-normal conditions, providing protection against unsafe IU operation during the IU filling, irradiation, and post-irradiation modes of operation. The Engineered Safety Features Actuation System (ESFAS) provides sense, command, and execute functions to maintain the facility confinement strategy and provides actuation process functions required to shut-down the processes and maintain processes in a safety condition. Both TRPS and ESFAS provide measured process values to the facility process integrated control system (PICS). Sections 7.1.2, Target Solution Vessel Reactivity Protection System, and 7.1.3, Engineered Safety Features Actuation System, of the SHINE FSAR states that the highly integrated protection system (HIPS) platform is used for the TRPS and ESFAS.

On May 26, 2020 (ADAMS Accession No. ML20148M279), the NRC staff issued an RAI requesting information on how the TRPS and ESFAS meet the applicable SHINE design criteria. SHINE submitted responses to these RAIs and associated FSAR updates on August 28, 2020 (ADAMS Package Accession No. ML20255A026). These RAIs were Enclosure

necessary for the NRC staff to determine that there is reasonable assurance that the TRPS and ESFAS are appropriately designed and will reliably provide adequate protection of public health and safety, and that applicable regulatory requirements are met. The following requests for information identify additional information needed for the NRC staff to perform its review of the SHINE TRPS and ESFAS.

The NRC staff previously issued a set of RAIs related to the HIPS platform on July 1, 2021 (ADAMS Accession No. ML21172A195). The NRC staff is preparing two additional sets of RAIs related to SHINEs instrumentation and control systems (ICSs). The subjects of these sets of RAIs are as follows:

1) Process Integrated Control System

2) Neutron Flux Monitoring and Radiation Monitoring Applicable Regulatory Requirements and Guidance Documents The NRC staff is reviewing the SHINE operating license application, which describes the SHINE irradiation facility (IF), including the IUs, and radioisotope production facility (RPF), using the applicable regulations, as well as the guidance contained in NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996 (ADAMS Accession No. ML042430055), and NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996 (ADAMS Accession No. ML042430048). The NRC staff is also using the Final Interim Staff Guidance

[ISG] Augmenting NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Format and Content, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012 (ADAMS Accession No. ML12156A069), and Final Interim Staff Guidance Augmenting NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors: Standard Review Plan and Acceptance Criteria, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors, dated October 17, 2012 (ADAMS Accession No. ML12156A075). As applicable, additional guidance cited in SHINEs FSAR or referenced in NUREG-1537, Parts 1 and 2, or the ISG Augmenting NUREG-1537, Parts 1 and 2, has been utilized in the review of the SHINE operating license application.

For the purposes of this review, the term reactor, as it appears in NUREG-1537, the ISG Augmenting NUREG-1537, and other relevant guidance can be interpreted to refer to SHINEs irradiation unit, irradiation facility, or radioisotope production facility, as appropriate within the context of the application and corresponding with the technology described by SHINE in its application. Similarly, for the purposes of this review, the term reactor fuel, as it appears in the relevant guidance listed above, may be interpreted to refer to SHINEs target solution.

Chapter 7 - Instrumentation and Control Systems TRPS and ESFAS The following regulatory requirement is applicable to RAIs 7-20 through 7-26:

Paragraph (b)(2) of 10 CFR 50.34, Contents of applications; technical information, requires, in part, that an FSAR include [a] description and analysis of the structures, systems, and components (SSCs) of the facility, with emphasis upon performance requirements, the bases, and the evaluations required to show that safety functions will be accomplished. The description shall be sufficient to permit understanding of the system designs and their relationship to safety evaluations.

RAI 7-20 TRPS and ESFAS System Operation NUREG-1537, Part 2, Section 7.4, Reactor Protection System, states, in part, that the safety analysis report (SAR) should describe the protection system, listing the protective functions performed by the [protection system], and the parameters monitored to detect the need for protective action. Section 7.4 further states that the facility should have operable protection capability in all operating modes and conditions, as analyzed in the SAR and [t]he range of operation of sensor (detector) channels should be sufficient to cover the expected range of variation of the monitored variable during normal and transientreactor operation. NUREG-1537, Part 2, Section 7.4, states, in part, that the protection system should be designed to perform its safety function after a single failure and to meet requirements for seismic and environmental qualification, redundancy, diversity, and independence. NUREG-1537, Part 2, Section 7.4, also states that the protection systems should be designed for reliable operation in the normal range of environmental conditions anticipated within the facility. Therefore, the design of the protection systems should consider features that can ensure the reliability of the system such as independence, redundancy, diversity, maintenance, testing, and quality components.

Similarly, NUREG-1537 Sections 7.1, Summary Description, and 7.5, Engineered Safety Features Actuation Systems, state that in the FSAR, the applicant should describe all the Engineered Safety Features (ESFs) in the facility design and summarize the postulated accidents whose consequences could be unacceptable without mitigation..These summaries should include the design bases, the performance criteria, and the full range of reactor conditions, including accident conditions, under which the equipment or systems must maintain function. The information to be reviewed should also include the design criteria of each ESF actuation system, and the design bases and functional requirements for the ESF actuation systems. Additionally, [t]he ESF actuation system should be designed not to fail or operate in a mode that would prevent the [protection systems] from performing its designed function, or prevent safe reactor shutdown. The FSAR should also describe the detector channels that sense the need for mitigation of possible consequences.

The SHINE FSAR does not have sufficient details and analysis of the design for the NRC staff to determine the adequacy of the protection systems and their

consideration of features that can ensure the reliability of the system such as independence, redundancy, diversity, maintenance, testing, and quality components. Parts (a) through (g) of this RAI are intended to address topics related to monitored variables, logic, safety functions, functional diversity, terminology, and calculations to obtain the necessary detail and analysis of the SHINE TRPS and ESFAS so that the NRC staff can make the applicable findings in Chapter 7 of NUREG-1537, Part 2.

As SHINE prepares responses to the RAIs below, it may consider uploading supporting reference documentation to its electronic reading room, such as the TRPS and ESFAS system requirement specifications; TRPS and ESFAS system design descriptions; and TRPS and ESFAS system design specifications.

Providing such information could be reviewed by the NRC staff to confirm the adequacy of certain design elements and calculations.

The information requested in parts (a) through (f) of RAI 7-20, below, is necessary for the NRC staff to make a reasonable assurance finding of adequate protection based on demonstration of the TRPS and ESFAS compliance to the identified design criteria, as well as the accuracy and completeness of descriptions in the SHINE FSAR. Specifically, the information requested in parts (a) through (f) of RAI 7-20, below, is necessary to support the following evaluation findings in Sections 7.4 and 7.5 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.

The protection system is sufficient to provide for all isolation and independence from othersubsystems requiredto avoid malfunctions or failures caused by the other systems.

The design considerations of the ESF actuation system give reasonable assurance that the system will detect changes in measured parameters as designed and will initiate timely actuation of the applicable ESF.

(a)(1) TRPS Monitored Variables SHINE Design Criterion 13, Instrumentation and Controls, requires instrumentation be provided to monitor variables and systems over the anticipated range of variation of the monitored variable during normal and transient conditions. Also, this criterion requires that the information provided be sufficient to verify that individual safety limits are protected by independent channels. SHINE FSAR Sections 7.3.1.1, Irradiation Unit Systems, and 7.4.3.2, Mode Transition, describe the modes of operation of the IU systems. The operator uses PICS to change modes of operation; however, the TRPS controls the mode of operation with permissives and interlocks of its assigned IU and provides protection against analyzed events. Furthermore, SHINE FSAR Section 7.4.2.1.4, Protection System Independence, references manual actuation of the safety functions and manual actuation capabilities via individual push

button, in part, to meet SHINE Design Criterion 16, Protection System Independence. Manual actuations must be based on information provided to the operator. Therefore, the TRPS should monitor and display necessary information for all monitored variables during normal operation and transient circumstances. The SHINE FSAR Table 7.4-1, TRPS Monitored Variables, lists process variables monitored by the TRPS, associated process analytical limits, safety logic, instrument range, accuracy, and instrument response for the TRPS. However, the SHINE FSAR does not identify what TRPS variables provide information to the operators in the control room (via the control console) to change the IU operation mode and control the IUs. SHINE FSAR Section 7.3.1.1 only describes capabilities provided in the PICS, and SHINE FSAR Section 7.4.3.2 only describes the transition criteria to move from one mode to another.

Update the SHINE FSAR to identify TRPS variables to be displayed to operate and monitor IU operation, including any necessary for operators to perform manual protective actions and to meet SHINE Design Criteria 13 and 16, and to verify that the facility has functional protection capability in all operating modes and conditions, as analyzed in the SHINE FSAR.

(a)(2) ESFAS Monitored Variables SHINE Design Criterion 13 requires instrumentation be provided to monitor variables and systems over the expected range of variation of the monitored variable during normal and transient operation. Also, this criterion requires that the information provided be sufficient to verify that individual safety limits are protected by independent channels.

SHINE FSAR Section 7.5.2.1.4, Protection System Independence, states, in part, automatic and manual actuation of the safety functions is used in meeting SHINE Design Criterion 16.

The ESFAS design: (1) should perform the functions necessary to ensure safety, and (2) ensure conformance to the design bases. The ESFAS monitors the IF and the RPF continually throughout the operation of processes within the facility. To perform its function, the ESFAS should monitor the necessary variables to actuate functions whenever an accident could occur for which the SHINE FSAR shows consequence mitigation is necessary. Manual actuations must be based on information provided to the operator. In addition, the ESFAS should include sensors (detectors) sufficient to cover the expected range of variation of the monitored variable during normal and transient operation (e.g., see SHINE Design Criterion 13).

SHINE FSAR Table 7.5-1, ESFAS Monitored Variables, lists process variables monitored by the ESFAS, associated process analytical limits, safety logic, instrument range, accuracy, and instrument response for the ESFAS. However, the SHINE FSAR does not identify what ESFAS variables provide information to the operators in the control room (via the

control console) to monitor operation and status of the IF and the RPF.

Section 7.3.1.1 only describes capabilities provided in the PICS.

Update the SHINE FSAR to identify ESFAS variables to be displayed, including any necessary for operators to perform manual protective actions and to meet SHINE Design Criteria 13 and 16, and to verify that the facility has functional protection capability in all operating modes and conditions, as analyzed in the SHINE FSAR.

(b) TRPS and ESFAS Logic SHINE Design Criterion 15, Protection System Reliability and Testability, requires that no single failure results in a loss of the protection function (see also RAI 7-11, ADAMS Accession No. ML21172A195). SHINE FSAR Section 7.4.3.4, Single Failure, states that [e]ach input variable to the TRPS for monitoring and indication only is processed on independent input submodules that are unique to that input. However, during the May 2021 regulatory audit of SHINEs Instrumentation and Controls (I&C) (ADAMS Package No.

ML21130A312) the NRC staff learned that the TRPS includes remote input sub-modules (RISMs) to gather data from each neutron flux detector system division and transmit it to the associated TRPS division. This information contradicts the statement in SHINE FSAR Section 7.4.3.4.

Similarly, SHINE FSAR Section 7.5.3.3, Single Failure, states that

[e]ach input variable to the ESFAS for monitoring and indication only is processed on independent input submodules that are unique to that input. The May 2021 regulatory audit did not identify if any RISMs are being used in the ESFAS or whether multiple inputs use the same RISM.

SHINE FSAR Section 7.4.3.4, Single Failure, describes the operational use of the safety-related enable nonsafety switch and the logic for this switch is depicted in Figure 7.4-1, TRPS Logic Diagrams, Sheets 12 and

13. However, during the May 2021 regulatory audit, SHINE stated that this description and depiction was not accurate and would be revised.

SHINE FSAR Section 7.5.3.3, Single Failure, states that the ESFAS

[also] contains a safety-related enable nonsafety switch. The ESFAS implementation of this switch was not discussed during the May 2021 2021 regulatory audit; however, sheets 22 and 24 of SHINE FSAR Figure 7.5-1, ESFAS Logic Diagrams, depict this switch in the same manner as it is depicted in the TRPS. It is not clear to the NRC staff whether SHINE intends to revise this description and depiction of ESFAS logic as it intends to do for the related TRPS logic.

Update the SHINE FSAR to accurately describe the design and operation of the TRPS and ESFAS logic, as necessary, in FSAR Sections 7.4.3.4 and 7.5.3.3, as well as SHINE FSAR Figures 7.4-1 and 7.5-1.

(c) Assignment of monitored variables to each TRPS Division and ESFAS Division SHINE Design Criterion 15 requires that no single failure results in a loss of the protection function. SHINE FSAR Section 7.4.2.1.3, Protection System Reliability and Testability, describes how the TRPS design addresses this criterion. As part of this description, SHINE states that the TRPS consists of three divisions of input processing and trip determination and two divisions of actuation logic arranged such that no single failure can prevent a safety actuation when required, and no single failure in a single measurement channel can generate an unnecessary safety actuation. However, SHINE FSAR Section 7.4.3.4, Single Failure, describes an exception:

Situations exist in the design where TRPS only actuates a Division A component and there is no corresponding Division B component, or, there is a passive check valve credited as a redundant component. These situations are considered acceptable since the safety function includes a separate, redundant, and passive component (i.e., check valve) which does not need to be monitored or manipulated by the TRPS.

The SHINE FSAR does not provide sufficient information for the NRC staff to assess whether this excepted condition is acceptable to prevent a single failure resulting in a loss of the protective function. Further, the SHINE FSAR does not clearly identify what variables or situations are only assigned to Division A.

SHINE Design Criterion 15 requires that no single failure result in a loss of the protection function. In the FSAR, Section 7.5.2.1.3, Protection System Reliability and Testability, describes how the ESFAS design addresses this criterion. As part of this description, the SHINE FSAR describes that the ESFAS consists of three divisions of input processing and trip determination and two divisions of actuation logic arranged such that no single failure can prevent a safety actuation when required.

(Note: Since there are several ESFAS functions which are based on two inputs in a one-out-of-two voting configuration, there are several single failures which could generate an unnecessary safety actuation).

However, SHINE FSAR Section 7.5.3.3, Single Failure, describes an exception:

Situations exist in the design where the ESFAS only actuates a Division A component and there is no corresponding Division B component, or there is a passive check valve credited as a redundant component. These situations are considered acceptable since the safety function includes a separate, redundant and passive component (i.e., check valve) which does not need to be monitored or manipulated by the ESFAS.

The SHINE FSAR does not provide sufficient information for the NRC staff to assess whether this excepted condition is acceptable to prevent a single failure resulting in a loss of the protective function. Further, the SHINE FSAR does not clearly identify what variables or situations are only assigned to Division A.

Update the SHINE FSAR to identify all variables that are only assigned to Division A for TRPS and ESFAS, as appropriate. Also, update the SHINE FSAR to justify how the excepted conditions identified in SHINE FSAR Sections 7.4.3.4 and 7.5.3.3, including use of passive safety components to provide a diverse activation, meet SHINE Design Criterion 15 and will not result in a single failure resulting in a loss of the protective function.

(d) Assignment of safety functions to the TRPS and ESFAS safety function modules (SFM)

The HIPS Topical Report (TR) TR-1015-18653, Design of the Highly Integrated Protection System Platform, Revision 2 (ADAMS Accession No. ML17256A892) Section 3.3, Trip Determination, describes how sensor inputs can be assigned to the SFM. Furthermore, HIPS TR Section 4.2, Safety Function Module, states, in part:

Each SFM is dedicated to implementing one safety function or function group. An example of a safety function is a reactor trip from low reactor coolant system (RCS) flow generated from an RCS flow sensor signal, where a safety function group would be a pressurizer pressure channel that has multiple trips and actuations (i.e., low pressure reactor trip, high pressure reactor trip, high pressure decay heat removal actuation, etc.). This results in the gate level implementation of each safety function being different from other safety functions.

SHINE FSAR Section 7.4.5.2.5, Simplicity, states, in part:

Dedicating SFMs to a function or group of functions based on its input provides inherent function segmentation creating simpler and separate SFMs that can be more easily tested. This segmentation also helps limit module failures to a subset of safety functions.

The SHINE FSAR does not describe how safety signals are assigned to each SFM. Table B-3.2.3, TRPS Input Variable Allocation, in the technical specifications (TSs) bases for Liming Condition for Operation (LCO) 3.2.3 describes the allocation of inputs to the TRPS modules.

From this table, it appears to the NRC staff that more than one input device provides a signal to each SFM. For example, the signals from wide range neutron flux, power range neutron flux, source range neutron flux, TOGS mainstream flow, TOGS dump tank flow, and TOGS oxygen concentration are assigned to the same SFM. If this is correct, this would contradict the information in SHINE FSAR Section 7.4.5.2.5 since the

signals from the neutron flux monitoring system and signals associated with the TOGS are transmitted to the same SFM.

Update the SHINE FSAR to clarify the function allocations within the TRPS and ESFAS, ensuring consistency between the SHINE FSAR and TSs. In particular, as requested in item (c) above, identify the functions only assigned to Division A. Also, update the SHINE FSAR to provide allocation and differences of safety functions to each SFM (which is a TRPS channel) for their implementation at the gate level.

(e)(1) Clarification of Terminology for Monitored Variables The names and terms for monitored variables used in the SHINE FSAR Chapter 7, Instrumentation and Control Systems, are not always consistent with those used in other chapters of the SHINE FSAR and the TSs. For example:

(i) FSAR Table 7.4-1, TRPS Monitored Variables, includes TSV fill isolation valves fully closed. However, TS Table B-3.2.3, TRPS Input Variable Allocation, uses the term TSV fill valve position indication. This same terminology issue may apply to other signals as well.

(ii) The SHINE FSAR Table 7.5-1, ESFAS Monitored Variables, identifies the ESFAS monitored variables. This table includes the iodine and xenon purification (IXP) upper three-way valve position indication, and its analytical limit to be active. However, the SHINE TS uses the term supplying as the analytical limit. It is not clear to the NRC staff if the term active means the same as supplying, which is the defined safe state of the valve, and the state of the solenoid when energized.

Revise the SHINE FSAR and SHINE TSs, as appropriate, to use consistent names and terms for all monitored variables.

(e)(2) Clarification of Terminology The SHINE FSAR uses the terms anticipated transient and design basis event in different sections. It is not clear to the NRC staff what the difference is between SHINEs use of these terms.

Revise the SHINE FSAR to clarify the difference - if any - between the terms anticipated transient and design basis event and use these terms consistently in the SHINE Design Criteria and ESFAS Criteria.

(f) TRPS and ESFAS Setpoint Methodology and Calculations NUREG-1537, Part 2, Section 7.4, Reactor Protection System, states, that the range of operation of sensor (detector) channels should be sufficient to cover the expected range of variation of the monitored variable during normal and transient (pulsing or square wave) reactor

operation. NUREG-1537, Part 2, Sections 7.3, 7.4, and 7.7 also state that sensitivity of each sensor channel should be commensurate with the precision and accuracy to which knowledge of the variable measured is required. NUREG-1537, Part 2, Section 7.5 states that the range and sensitivity of ESF actuation system sensors should be sufficient to ensure timely and accurate signals to the actuation devices.

Regulations in 10 CFR 50.36(c)(1)(ii)(A) state that limiting safety system settings are settings for automatic protective devices related to those variables having significant safety functions. This clause requires that where a limiting safety system setting (LSSS) is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

Regulations in 10 CFR 50.36(c)(3) state, Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

The TRPS is responsible for protecting the individual safety limits (SLs) using independent channels when the facility operates in accordance with the TS LCOs. SHINE TS, Section 2.0, defines SLs to protect the primary system boundary (PSB) and LSSS for safety systems to initiate their protective functions. The SHINE FSAR, Table 7.4-1, identifies the variables monitored by the TRPS. This table also provides instrument range, accuracy for each variable monitored, and its analytical limit (AL).

The LSSS should provide margin to the AL of each variable monitored during each mode of operation.

For the TRPS monitored variables, TS Table 3.2.3-a identifies the setpoints for the safety function to protect against analyzed events and conditions. The SHINE FSAR does not describe the methodology used to determine these setpoints and only notes that a setpoint methodology was used to determine setpoints for variables monitored by the TRPS.

The setpoints for protective function should be based on a documented analysis methodology that identifies assumptions and accounts for instrument uncertainties, such as environmental allowances and measurement computational errors associated with each element of the instrument channel.

Revise the SHINE FSAR to summarize the setpoint methodology used to establish the setpoints or LSSS from the analytical limits for the variables monitored by the TRPS and ESFAS. The summary of the setpoint methodology should include parameters that typically consider instrument precision, sensitivity, accuracy, loop uncertainties, and computational errors. Also, describe how SHINE determined equipment accuracy identified in SHINE FSAR Tables 7.4-1 and 7.5-1 to bound uncertainties and how the equipment accuracy is used in the setpoint methodology.

This information is needed for the NRC staff to verify the safety channels and protective responses are sufficient to ensure that no safety limit,

limiting safety system setting, or related limiting condition of operation discussed and analyzed in the SHINE FSAR will be exceeded.

RAI 7-21 TRPS and ESFAS Logic Design and Implementation Section 7.4 of NUREG-1537, Part 2, states, in part, that the FSAR should contain information such as descriptive information, including system logic and schematic diagrams, showing all instruments, computer hardware and software, electrical, and electromechanical equipment used in detecting reactor conditions requiring scram or other reactor protective action and in initiating the action.

Additionally, [t]he logic, schematic, and circuit diagrams should be included and should show independence of detector channels and trip circuits.

Additionally, Section 7.5 of NUREG-1537, Part 2, states, in part, that the FSAR should contain information such as logic and schematic diagrams[, as well as]

description[s] of instruments, computer hardware and software, electromechanical components, detector channels, trip devices and set points.

The HIPS platform is composed of several modules. One of these modules is the SFM, which performs the logic decision to initiate the required protective trips and actuations. The SHINE FSAR includes logic diagrams for the TRPS and ESFAS to perform their safety functions. However, the logic diagrams in the FSAR dont identify in which HIPS module each safety function is performed to ensure that specified design limits are not exceeded. Also, the FSAR does not describe nor include logic diagrams for signal conditioning.

Revise the SHINE FSAR to describe the logic used to generate discrete signals from analog signal inputs to the TRPS and ESFAS, as well as the logic used to implement operational and maintenance bypass and permissives. Also, revise the FSAR to describe how monitored signals are input to the TRPS and ESFAS, conditioned, and evaluated against defined setpoints in the safety function module (i.e., the logic to generate safety signals).

The information is necessary for the NRC staff to make a reasonable assurance finding of adequate protection based on demonstration of the ability of the TRPS and ESFAS to perform their intended functions. Specifically, the information requested is necessary to support the following evaluation findings in Sections 7.4 and 7.5 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.

The design considerations of the ESF actuation system give reasonable assurance that the system will detect changes in measured parameters as designed and will initiate timely actuation of the applicable ESF.

RAI 7-22 TRPS and ESFAS Design and Development Process Sections 7.4 and 7.5 of NUREG-1537, Part 2, state, in part, that hardware and software for computerized systems should meet the guidelines of Institute of Electrical and Electronics Engineers (IEEE) Std. 7-4.3.2-1993, IEEE Standard Criteria for digital Computers in Safety Systems of Nuclear Power Generating Stations, Regulatory Guide 1.152, Revision 1, Criteria for Digital Computers In Safety Systems of Nuclear Power Plants, and American National Standards Institute/American Nuclear Society (ANSI/ANS)-10.4-1987, Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry.

The SHINE FSAR Sections 7.4.2.2.2, Software Requirements Development, and 7.5.2.2.2, Software Requirements Development, identify TRPS and ESFAS criteria associated with the software requirements development, respectively.

SHINE FSAR Section 7.4.5, Highly Integrated Protection System Design, provides an overview of the system design process for the HIPS platform for the TRPS. Section 7.5.5 of the FSAR addresses the design for the ESFAS equipment by referencing to Section 7.4.5. Section 7.4.5 states that the development of the HIPS equipment for the TRPS and ESFAS had been delegated to SHINE's safety-related HIPS vendor. Section 7.4.5.4 of the SHINE FSAR describes the design process for the vendor to follow. However, the SHINE FSAR does not provide information to determine whether the HIPS vendor followed this process for the TRPS and ESFAS and the results obtained.

Revise the SHINE FSAR to summarize how the HIPS vendor implemented the process described in the FSAR for the TRPS and ESFAS. This summary should include development procedures and test results. Also, revise the FSAR to describe how SHINE conforms with the guidelines of IEEE 7-4.3.2 and RG 1.152, as applicable. Note: This RAI is related to RAI 7-17, which asks SHINE to update the FSAR to describe how codes and standards listed in the SHINE FSAR are used to design each of the SHINE I&C systems (ADAMS Accession No. ML21172A195).

The information is necessary for the NRC staff to make a reasonable assurance finding of adequate protection based on demonstration of the ability of the TRPS and ESFAS to perform their intended functions. Specifically, the information requested is necessary to support the following evaluation findings in Sections 7.4 and 7.5 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.

The design considerations of the ESF actuation system give reasonable assurance that the system will detect changes in measured parameters as designed and will initiate timely actuation of the applicable ESF.

RAI 7-23 TRPS and ESFAS Technical Specifications (TS)

NUREG-1537, Part 1, Section 7.2.4, System Performance Analysis, states, in part, that [t]he applicant should conduct a performance analysis of the proposed I&C system to ensure the design criteria and design bases are met and license requirements for the performance of the system are specified.

The system performance analysis should encompass[t]echnical specification LSSSs [limiting safety system settings], LCOs, and surveillance requirements for the I&C system. These parameters and requirements should include system operability tests, trip or actuation setpoint checks, trip or actuation-setpoint calibrations, and any system response-time tests that are required. Surveillance intervals should be specified and the bases for the intervals, including operating experience, engineering judgment, or vendor recommendation should be discussed.

The information requested in parts (a) through (c) of RAI 7-23, below, is necessary for the NRC staff to make the following evaluation findings in Sections 7.4 and 7.5 of NUREG-1537, Part 2:

The protection channels and protective responses are sufficient to ensure that no safety limit, safety system setting, or [protection system]-related limiting condition of operation discussed and analyzed in the SAR will be exceeded.

The bases for technical specifications, including surveillance tests and intervals for the ESF actuating system, give reasonable assurance of actuation of ESFs when required.

(a) SHINE FSAR Section 7.4.4.5, Technical Specifications and Surveillance, states that [l]imiting Conditions for Operation and Surveillance Requirements are established for TRPS logic, voting, and actuation divisions and instrumentation monitored by TRPS as input to safety actuations. SHINE FSAR Section 7.5.4.6, Technical Specifications and Surveillance, provides a similar statement for the ESFAS.

However, the SHINE FSAR does not include a description or reference to the system performance analysis that encompasses the TS LSSSs, LCOs, and surveillance requirements for the TRPS and ESFAS.

Revise the SHINE FSAR to include a reference to and/or a description of the system performance analysis that addresses the TS LSSSs, LCOs, and surveillance requirements for the TRPS and ESFAS.

(b) SHINE TS LCOs 3.2.3 and 3.2.4 address the input devices and the actuation determination portions of the TRPS and ESFAS. The SHINE TS bases for LCO 3.2.3 and 3.2.4 identify the allocation of inputs to SFMs and hardwired modules (HWMs). This information appears to show that more than one input device provides a signal to each SFM or HWM. However, the TS Basis 3.2.3 notes that one input for TRPS is through an HWM. This could be understood as requiring that one of the 32 possible inputs to HWM must be

operable. Therefore, it is not clear to the NRC staff what happens to the other remaining inputs and other modules. Further, it is not clear to the NRC staff how the facility operator would determine operability of an HWM.

Revise the SHINE FSAR to clarify how the HWM is addressed in the TS LCO 3.2.3, including inputs and determination of operability.

(c) SHINE TS Basis 3.2.1 describes operation of the equipment interface module (EIM) and safety actuation logic. This basis also describes requirements for operability of the EIMs. The EIM receives signals from the scheduling, bypass and voting modules (SBVMs) in Divisions A and B and control signals from the PICS. SHINE states that the EIM will give priority to the safety signal from the SBVMs over the non-safety signal from PICS. However, the SHINE FSAR and TS bases do not describe how the PICS can control an output when an EIM becomes inoperable. The TS bases only describe what happens to the actuation logic when an EIM is inoperable.

Revise the SHINE FSAR to describe how the EIM will treat signals from PICS when an EIM is inoperable.

RAI 7-24 Facility Master Operating Permissive SHINE FSAR Sections 7.4.2.2.9, Operational Bypass, Permissives, and Interlocks, and 7.5.2.2.9, Operational Bypass, Permissives, and Interlocks, describe the operational bypass, permissives, and interlocks for the TRPS and ESFAS. SHINE FSAR Sections 7.4.3.2, Mode Transition, and 7.5.2.2.9 describe, in part, how the TRPS and ESFAS incorporate the Facility Master Operating Permissive key switch in the system design. This key switch will be used to select operation in the normal, unsecured mode, or operationally secured. The NRC staff notes the key switch is not identified in the SHINE FSAR Table 7.4-1 or Table 7.5-1. The SHINE FSAR should also identify all inputs used by the TRPS and ESFAS to perform its functions, including non-safety signals.

Revise the SHINE FSAR to describe the design and configuration of the facility master operating permissive. Include all inputs to be used by the TRPS and ESFAS to perform its functions (also see items (a)(1) and (a)(2) for RAI 7-20 above).

The information is necessary for the NRC staff to make a reasonable assurance finding of adequate protection based on demonstration of the ability of the TRPS and ESFAS to perform their intended functions. Specifically, the information requested is necessary to support the following evaluation findings in Sections 7.4 and 7.5 of NUREG-1537, Part 2:

The design reasonably ensures that the design bases can be achieved, the system will be built of high-quality components using accepted engineering and industrial practices, and the system can be readily tested and maintained in the design operating condition.

The design considerations of the ESF actuation system give reasonable assurance that the system will detect changes in measured parameters as designed and will initiate timely actuation of the applicable ESF.

RAI 7-25 ESFAS Criticality Safety System (a) SHINE FSAR Section 7.5.2.1.8, Criticality Control in the Radioisotope Production Facility, states, in part, that [t]he ESFAS provides two safety functions as required by the SHINE criticality safety program described in Section 6b.3. These two safety functions include 1) the vacuum transfer system (VTS) Safety Actuation, as described in SHINE FSAR Section 7.5.3.1.17, VTS Safety Actuation, and 2) the Dissolution Tank Isolation, as described in SHINE FSAR Section 7.5.4.1.18, TSPS Dissolution Tank Level Switch.

The VTS Safety Actuation includes an [a]ctuation on a VTS vacuum header liquid detection switch signal [to protect] against on overflow of the vacuum lift tanks and potential criticality event, as described in SHINE FSAR Section 7.5.4.1.8, VTS Vacuum Header Liquid Detection Switch. Additional details on the VTS are included in SHINE FSAR Section 6b.3.2.5, Vacuum Transfer System, including references to certain signals used by the ESFAS to initiate safety functions and components. Specifically, FSAR Section 6b.3.2.5 states that the vacuum headers are equipped with liquid detection that stops transfers upon detection of liquid.

Further, SHINE FSAR Section 7.5.3.1.17 identifies safety functions initiated by the VTS Safety Actuation Isolation, including the deenergizing of VTS vacuum break valves. While SHINE FSAR Section 6b.3.2.5 identifies valves, a three-way valve, and a ball-check valve, there is no reference to the vacuum break valves identified in SHINE FSAR Section 7.5.3.1.17.

The Dissolution Tank Isolation safety function includes the TSPS [target solution preparation system] dissolution tank level switch signal [to protect]

against a criticality event due to excess fissile material in a non-favorable geometry, as described in SHINE FSAR Section 7.5.4.1.18. Additional details on the TSPS and associated signals are included in SHINE FSAR 6b.3.2.4, Target Solution Preparation System, which states that high level within the dissolution tanks requires application of the DCP [double contingency principle] to prevent criticality accidents. The dissolution tanks are equipped with high level controls that are interlocked with isolation valves.

The NRC staff seeks clarification on the relationship between descriptions of signals and equipment associated with the two safety functions provided by the ESFAS, as required by the SHINE criticality safety program.

(1) Confirm that VTS vacuum header liquid detection switch signal described in SHINE FSAR Section 7.5.4.1.8 is the same signal as liquid detection described in SHINE FSAR Section 6b.3.2.5.

(2) Confirm which valves identified in SHINE FSAR Section 6b.3.2.5 correspond with the vacuum break valves identified in SHINE FSAR Section 7.5.3.1.17.

(3) Confirm that the TSPS dissolution tank level switch signal described in SHINE FSAR Section 7.5.4.1.18 is the same signal as the high level controls described in SHINE FSAR Section 6b.3.2.4.

(b) SHINE FSAR Section 7.5.1, System Description, states that the ESFAS monitors variables for criticality safety to actuate the dissolution tank isolation safety function, actuate on a vacuum transfer system (VTS) vacuum header liquid detection, and actuate the VTS safety function. Further, FSAR Section 7.5.2.1.8 defines SHINE Design Criterion 37 associated with criticality control in the RPF. In the description provided on how the ESFAS design meets this criterion, the NRC staff could not identify descriptions of the safety functions to be performed by the ESFAS.

Provide a description and details of how ESFAS implements SHINE Design Criterion 37.

(c) By letter dated January 21, 2021 (ADAMS Accession No. ML21029A038),

SHINE requested exemption from the monitoring requirements of paragraph (a) of 10 CFR 70.24, Criticality Accident Requirements, for the irradiation unit cells and the material staging building. SHINE FSAR Section 7.5.2.1.8, Criticality Control in the Radioisotope Production Facility, provides SHINE Design Criterion 37, which describes criterion for criticality control and alarming. It is not clear if SHINE Design Criterion 37 and associated FSAR descriptions related to the SHINE criticality monitoring system in SHINE FSAR Chapter 7 are impacted by the January 2021 exemption request.

Confirm whether the SHINE Design Criterion 37 and associated FSAR criticality control and alarming descriptions in Chapter 7 are expected to be impacted by the January 2021 exemption request and associated configuration of the criticality monitoring system. Update the SHINE FSAR Chapter 7, as appropriate, to reflect the current SHINE Design Criterion 37 and associated configuration of the criticality monitoring system.

The information requested in parts (a) through (c) of RAI 7-25, above, is necessary for the NRC staff to make a reasonable assurance finding of adequate protection based on demonstration of the ESFAS compliance to the identified design criteria, as well as the accuracy and completeness of descriptions in the SHINE FSAR. Specifically, the information requested in parts (a) through (c) of RAI 7-25, above, is necessary to support the following evaluation findings in Section 7.5 of NUREG-1537, Part 2:

The applicant has analyzed the scenarios for all postulated accidents at the facility, including all accidents for which consequence mitigation by engineered safety features (ESFs) is required or planned. The staff evaluated the ESFs and has determined that the designs of their actuation systems give reasonable assurance of reliable operation if required.

The applicant has considered the environments in which the ESFs are expected to operate, and the applicable actuation systems have been designed accordingly to function as required.

The design considerations of the ESF actuation system give reasonable assurance that the system will detect changes in measured parameters as designed and will initiate timely actuation of the applicable ESF.

RAI 7-26 SHINE Design Criteria 1 - 8 Note 2 of SHINE FSAR Chapter 3, Design of Structures, Systems, and Components, states that [t]he generally-applicable design criteria 1 - 8 from Table 3.1-3 are not specifically listed even though they are generally applicable to most SSCs. However, it is not clear to the NRC staff whether these design criteria are applicable to the TRPS and ESFAS.

Confirm whether SHINE Design Criteria 1 - 8 are applicable to the TRPS and ESFAS. Update the SHINE FSAR to describe the relation of the TRPS and ESFAS design bases to the applicable SHINE Design Criteria 1-8.

This information is necessary for the NRC staff to understand the relation of the design bases to the principle design criteria of facility, as required by 10 CFR 50.34.