ML042960598
| ML042960598 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 10/08/2004 |
| From: | - No Known Affiliation |
| To: | - No Known Affiliation, Office of Nuclear Reactor Regulation |
| References | |
| FOIA/PA-2004-0307 | |
| Download: ML042960598 (13) | |
Text
72 1 1 J(&6 /
O5X4 6-2: c 2 0 A
C)/'
3 Pdart~
Q ) XcWe a/7 7 E
/XA9
/2675/16 -/,
c,---
4'e,
PVNGS UPDATED FSAR 8.2 OFFSITE POWER SYSTEM 8.
2.1 DESCRIPTION
The offsite power system consists of six physically independent circuits from the Arizona-New Mexico-California-Southern Nevada power grid to the PVNGS switchyard.
Offsite power from the switchyard through three startup transformers and six intermediate buses is provided to supply two physically independent preferred power circuits to the ac power distribution system of each unit.
The offsite power system is described in this section and is depicted in figures 8.1-1 and 8.2-1.
8.2.1.1 Transmission Network The transmission system associated with PVNGS supplies offsite ac power at 525 kV for startup, normal operation, and safe shutdown of Units 1, 2, and 3. The six 525 kV lines of this system, PVNGS to RUDD, PVNGS to Westwing I, PVNGS to Westwing II, PVNGS to Kyrene, PVNGS to North Gila, and PVNGS to Devers, cover distances of approximately 37, 44, 44, 74, 114, and 235 miles, respectively.
All six transmission lines associated with PVNGS traverse relatively flat terrain and their design meets grade B requirements specified by the National Electrical Safety Code, sixth edition.
The Code specifies loading areas, wind loads for towers and conductors, and safety factors to be used.
The conductors and the overhead ground wires are dampened to maintain acceptable levels of vibration. None of the 525 kV lines associated with PVNGS cross one another.
There is a crossing of the Westwing I and Westwing II lines by 525 kV line not associated with PVNGS, approximately 43 miles from PVNGS.
June 2003 8.2-1 Revision 12 LDCR 02-F023
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM The six transmission lines associated with the PVNGS switch-yard, and their, rights-of-way, are designed so as to minimize line proximities that could result in simultaneous failure of more than one circuit.
Based on historical transmission system data, the frequency of occurrence for breakage of the span of line that crosses the two Westwing and Westwing lines is 1.1 x 10-5 per year.
In the highly unlikely event of grid instability resulting from simultaneous short-circuiting of both Westwing lines, a loss of all nonemergency AC power event could result.
This design basis event is evaluated in chapter 15.
8.2.1.2 Switchyard and Connections to the Onsite Power System Prior to the construction of PVNGS there were no transmission lines to, or transmission switchyards in the vicinity of, the site.
Construction of PVNGS includes construction of a 525 kV switchyard of the breaker-and-a-half design in which three breakers are provided for every two terminations, either line or transformers.
The switchyard is connected to the six 525 kV transmission lines associated with PVNGS, the 525/24 kV turbine-generator main transformers, and the 525/13.8 kV startup transformers, as shown in figure 8.2-2.
These figures reflect the development of the switchyard as each unit is added.
Each turbine-generator connects to the switchyard through a main transformer, a 525 kV tie line, and two 525 kV switchyard breakers, as shown in figure 8.2-2.
Physical connections between the units and the 525 kV switchyard are shown in figure 8.2-1.
June 2003 8.2-2 Revision 12 LDCR 02-F023
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM The three startup transformers connect to the switchyard through two 525 kV switchyard breakers each, and feed six 13.8 kV intermediate buses.
These buses are arranged in three pairs, each pair feeding only one unit.
The intermediate buses for Units 1, 2, and 3 are inter-connected to the startup transformers so that each unit's buses can access all three startup transformers when all startup transformers are connected to the switchyard.
The intermediate buses are connected to the onsite power system by one 13.8 kV transmission line per bus (two per unit).
These lines are physically separated to minimize the possibility of simultaneous failure of the lines.
8.2.1.2.1 Switchyard and Offsite Power System Development Figure 8.2-2 depicts the switchyard and 13.8 kV bus arrangements.
Necessary 525 kV breaker installation is accomplished during refueling, if possible, or during operation.
All operating 525 kV positions are transferred to the opposite bus: thus, continuity of offsite power is maintained.
8.2.1.2.2 Water Reclamation Facility Load Shedding The Water Reclamation Facility loads are load shed from the Unit 1 intermediate buses upon a Unit 1 BOP ESFAS Mode 1 signal concurrent with switchyard voltage at or below a value which could result in a trip of offsite power in the event of a safe shutdown or emergency event.
June 2003
- 8. 2-3 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM 8.2.1.3 Compliance with Design Criteria and Standards The following analysis demonstrates compliance with General Design Criteria 17 and 18 of 10CFR50, Appendix A, and Regulatory Guide 1.32.
8.2.1.3.1 Criterion 17 --
Electric Power Systems In addition to the features detailed in paragraphs 8.2.1.1 and 8.2.1.2, compliance with Criterion 17 is further demonstrated by the following:
A.
If one of the two 13.8 kV startup transmission lines per unit is interrupted, the remaining line can supply offsite power to both engineered safety features (ESF) buses, as shown in engineering drawing 01, 02, 03-E-MAA-002.
B.
The two 13.8 kV transmission lines, supported on independent structures, are separated so as to avoid the possibility that the structural collapse of one will cause an outage of the other 13.8 kV line.
C.
The 13.8 kV system is protected from lightning and switching surges by lightning protective equipment and by overhead static lines.
D.
Design of the 125 V-dc system for the switchyards con-sists of two independent dc systems.
Each of the two systems consist of a separate 125 V-dc battery, battery charger, and distribution system.
Cable separation is maintained between the two systems. A single failure caused by a malfunction of either of the two 125 V-dc systems does not affect the performance of the other system.
The ability of the switchyards to supply off-site power to the plant is not affected by the loss of one of the two 125 V-dc systems.
June 2003 8 :2-4 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM E.
Two isolated 13.8 kV supplies from the intermediate 13.8 kV buses are provided to the switchyards.
The ac load is divided between two power panels and loss of one feeder from the plant does not jeopardize con-tinued operation of the switchyard equipment.
F.
For reliability and operating flexibility, the switch-.
yard design includes a breaker-and-a-half arrangement for each circuit along with breaker failure backup protection.
Each breaker has two trip coils on separate, isolated dc control circuits.
These pro-visions permit the following:
- 1.
Any transmission line can be cleared under normal or fault conditions without affecting any other transmission line.
- 2.
Any circuit breaker can be isolated for maintenance without interrupting the power or protection to any circuit (subject to'limitations of power system development paragraph 8.2.1.2.1).
- 3.
Short circuits on a section of bus can be isolated without interrupting service to any circuit other than that connected to the faulty bus section.
G.
The offsite sources from the 525 kV switchyards to the startup transformers are separate and independent.
The failure or structural collapse of one system or structure does not affect other offsite sources.
H.
The offsite sources from the startup transformers to the 13.8 kV switchgear located at the units are independently and separately routed.
I.
Two physically independent circuits are provided for offsite power to the onsite distribution system for June 2003 S. 2-5 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM each unit; The offsite source normally connected to each ESF bus is immediately available to supply components important to safety following a postulated loss-of-coolant accident.
Either of the two offsite sources to each ESF bus, if available, can be connected by control switch operation in the control room.
(subject to the limitations of power system development paragraph 8.2.1.2.1).
8.2.1.3.2 Criterion 18 -- Inspection and Testing of Electric Power Systems The 13.8 kV and 4.16 kV circuit breakers can be inspected, maintained, and tested on a routine basis. This can be accomplished without removing the generators, transformers, or transmission lines from service (subject to limitations of power system development paragraph 8.2.1.2.1).
Transmission line protective relays can be tested on a routine basis.
This can be accomplished without removing the transmission lines from service.
Generator, main transformer, and service transformer relays are tested on a routine basis when the generator is offline.
Onsite power components will be periodically inspected and maintained as required.
This can be accomplished without removing the transmission lines, generators, or transformers from service.
8.2.1.3.3 Regulatory Guide 1.32 As described-in paragraph 8.2.1.3.1, listing I, an independent immediate access circuit is provided to each Class lE bus for each unit.
June 2003 B. 2-6 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM 8.2.1.3.4 Industry Standards The design complies with applicable standards and recommendations of:
Institute of Electrical and Electronics Engineers, Inc.
(IEEE) National Electrical Manufacturer's Association (NEMA)
National Electrical Code (NEC)
American Society of Civil Engineers (ASCE)
Underwriters' Laboratory, Inc. (UL)
American Iron and Steel Institute (AISI) 8.2.2 ANALYSIS ThIe transmission system associated with PVNGS is planned so that the loss of a single transmission element (i.e., line or transformer) does not result in loss of load, transmission overload, undervoltage condition, or loss of system stability to the Arizona-New Mexico-California-Southern Nevada extra high voltage (EHV) grid.
Offsite power supply reliability is determined by the performance of the six 525 kV supply circuits associated with PVNGS.
The source stations for these circuits (RUDD Westwing, Kyrene, Miguel, and Devers) all have three or more connected circuits of 230 kV and above, which provide the appropriate reliability.
Power flow studies conducted for the described system indicate that the system can reliably deliver power to all project par-ticipants using the above planning criteria.
Dynamic stability studies. have shown that the system can withstand the following disturbances without loss of system stability or loss of load:
June 2003 8.2-7 Revision 12 LDCR 02-F023
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM A.
A permanent 3-phase fault on the switchyard 525 kV bus with subsequent loss of the critical 525 kV line.
B.
A sudden loss of one of the three PVNGS units with no underfrequency load-shedding measures in effect.
C.
The sudden loss of the largest single load on the Arizona-New Mexico-California-Southern Nevada system.
In withstanding these disturbances, which are used as design criteria, the system exhibits a very stable response, with significant positive damping achieved and with system frequency deviation held within acceptable limits.
(Salt River Project letter to APS # SALT RIVER PROJECT 20020206, "Final Report for the 2002 Palo Verde / Hassayampa Operating Study",
2/6/2002).
These results represent the response of the system associated with PVNGS with 7% generation stability margin.
Although these studies conclude that a PVNGS unit trip would not cause grid instability, certain chapter 15 accident analyses conservatively assume that offsite power is lost as a consequence of a PVNGS turbine trip.
Refer to section 8.3.4 and table 15.0-0.
Grid availability data on EHV systems in the area indicate an outage rate of 2.08 total outages per year per 100 line miles.
Of these, 1.08 are due to planned outages and 1.00 are due to forced outages.
Due to all causes, the outage ratio for 500 kV lines in the area is 0.00180.
On 230 kV systems in the area, similar data indicate outage rates of 6.59 total outages per year per 100 line miles.
Of these, 2.97 are due to planned outages and 3.61 are due to forced outages.
Due to all causes, the outage ratio for 230 kV lines in the area is 0.0394.
June 2003 8.2-8 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM These outages are mio1t commonly attributable to lightning.
Other causes are fog, contamination, flooding, other aspects of weather, falling objects, equipment failure, emergency maintenance, employee error, and, hypothetically, dust contamination.
The chief constituents of dust storms are nonconducting clay dust (usually quartz) and conducting gypsum (calcium sulphate) which can contaminate the insulators.
This contamination increases the probability of flashover, especially with fog or dew, by disclosing the salts to form an electrolyte.
However, dust buildup is reduced by the self-clearing action of the "VI' string insulator configuration used in EHV line construction and by the abrasive action of the dust and sand.
Also, any adverse conditions resulting from insulator contamination within the switchyard can be corrected by washing the insulators.
APS has never experienced a flashover in any of its EHV switchyards due strictly to dust on insulators and has found that dust storms contribute little to the outage frequency of EHV transmission lines.
Likewise, APS has not experienced any known dust-caused insulation failures at the 15 kV or 4 kV voltage levels in either open substation facilities or enclosed switchgear.
Therefore, it is felt that dust loading on the 13.8 kV system will not be a problem.
The system is designed such that, with rare exceptions, forced outages do not result in loss of load.
Other forms of contamination that increase the probability of flashover in certain areas, especially near the Pacific coast, are sea-salt deposits and industrial contaminations.
The insulators can become contaminated by the salt deposits and June 2003 B. 2-9 Revision 12
PVNGS UPDATED FSAR OFFSITE POWER SYSTEM when fogging conditions exist, flashovers are more likely to occur.
To minimize the effect of both salt and industrial contamination, the insulators are washed with demineralized water.
The frequency of washing depends on the area.
Some areas near the Pacific Coast require washing once a month while areas farther inland require washing every 90 days.
The use of semi-conducting glazed insulators also reduces the flashover rates in areas of high contamination.
No washing of insulators is anticipated in the desert regions.
June 2003 8.2 -10 Revision 12
10 CFR Ch. I (l-1 AnticiPated operatinoanzc ated operational Occur crrences.t onditiOns Of normal oenceso nehnth ected to Occur One or snore times duhae fe of the nuclear Power unit adad re not limited to loss of piowe nd nlude l slatlon pumps, tripping of erto a.ll r-4 the turb I oatar set, isolation of th te ma rine C
g Id loss of all offelte power.
anCnex ission ir.RegulOtOrY Commlso Pt. 50, App. A Lout the unit, particularly In loca-
-uch as the containment and control re detection and fighting systems of piate capacity and capability shall be 1ed-and designed to minimize the ad-effects of fires on structures, systems, Omponents important to safety. Fire-ng systems shall be designed to assure their rupture or Inadvertent operation not significantly impair the safety ca-tg of these structures, systems, and CaRrET3A
- 1. Overall Requirements
~T~erlon 1-QualitY-3tandard, and ructures, Systems, and components imhsp at to safety shall be designed fab iY 3cted, and tested to qualityada nsurate with the Importance ftesft IctiOns to be performed.Wee~ee 1
- Ognlzed codes and stands are 1Y shall be identifled and evlutdode mine their applicabflity adeq tnd TicIency and shall be supplemented or difled as necessary to assurea ult
,duct in keeping with the reuiedlaft ctlon. A quality assurance Prog Shf established and Implemented in order to vide adequate assurance that these struc-5s. systems, and components wil satisfan_
1y Perform their afetyafunctbonsy Aqa pro teo records of the design, fabrication ftion. and testing of structures sye component important tp safety shall be ntained by or under the control Of the lear Power unit licensee throuigot the of the unit.
iterion 2-Design bases for proteciona na natural phenomena. Structures. sys-3, and components important to safety I be designed to withstand the effects of xal phenomena such as earthquakes, tor-
'es, hurricanes, floods, tsunaraj, and
'es without loss Of capability to perform
- safety functions. 'he design bases for structures. systems. and Components reflect: (1) Appropriate consideration of nost severe of.the natural phenomena have been historically reported for the and surrounding-area, with Sufficient In for the limited accuracy, quantity,
>eriod of time in which the historical have been acctunulated. (2) appropriate Inatlons of the effects of normal and ane-t conditions with the effects of the nat-Phenomena and (3) the Importance of
,fety functions to be performed.
'ron 3-Fire Protection. Structures, syr-and components important to safety be dsiged nd lcatd t
- miimize, tentwit othr sfetyreqireents, ubablit an efect f fresandexplo-Noncmbutlbl an hea reistant lalsshal beuse wheeve prctical ered in designing the system against a.
failure are under development.
Z I vEntironmental and dynamic ef-
/esign bases. Structures, systems, and
. prponents important to safety shall be de-
> gped to accommodate the effects of and to ompatible with the environmental condi-associated with. normal operation, aljtenance, testing, and postulated acci-
- pets including loss-of-coolant accidents.
'these structures, systems, and components halU be appropriately protected against dy-jamic effects, Including the effects of mis-siles, pipe whipping, and discharging fluids.
that may result from equipment failures and from events and conditions outside the nu-dear power unit. However, dynamic effects associated with postulated pipe ruptures In naclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the pip-ing.
Criterion S-Sharing of structures, systems, and components. Structures, systems, and components Important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not sig-nificantly impair their ability to perform their safety functions, Including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units.
Il. Protection by Multiple Fission Product Barriers Criterion 10-Reactor design. The reactor core and associated coolant,.control, and protection systems shall be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceed-ed daring any condition of normal operation, Including the effects of anticipated oper-ational occurrences.
Criterion 11-Reactor inherent protection.
The reactor core and associated coolant sys-tems shall be designed so that in the.power operating range the net effect of the prompt inherent nuclear feedback characteristics tends to compensate for a rapid Increase In reactivity.
Criterion 12-Suppression of reactor power os-cillatiots. The reactor core and associated Coolant, control, and protection systems shall be designed to assure that power oscil-
- lations which can result in conditions ex-ceeding specified acceptable fuel design lim-its are not possible or can be reliably and readily detected and suppressed.
Criterion 13-Instrumentation and control. In-strumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the Integ-rity of the reactor core, the reactor coolant pressure boundary, and the containment and Its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.
Criterion 14-Reactor coolant pressure bound-ary. The reactor coolant pressure boundary shall be designed, fabricated, erected, and tested so as to have an extremely low prob-ability of abnormal leakage, of rapidly prop-agating failure, and or gross rupture.
Criterion 15-Reactor coolant system design.
The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reac-tor coolant pressure boundary are not ex-ceeded during any condition of normal oper-ation, including anticipated operational oc-currences.
Criterion 16-Containment design. Reactor containment and associated systems shall be provided to establish an essentially leak-tight barrier against the uncontrolled re-lease of radioactivity to the environment and to assure that the containment design conditions Important to safety are not ex-ceeded for as long as postulated accident conditions require.
Criterion 17-Electric power systems. An on-site electric power system and an offsIte electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the re-actor coolant pressure boundary are not ex-ceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital func-tions are maintained in the event of postu-lated accidents.
The onsite electric power supplies, includ-ing the batteries, and the onsite electric dis-tribution system, shall have sufficient Inde-pendence. redundancy, and testability to per-form their safety functions assuming a sin-gle failure.
19 A
Pt. An ADDr. A in i-ro &-k I o,.^ -_
,clear Regulaltory Corr l
Ad Ah IMP*
- ~~~~-_W_,O ts 1.lt-0 Edi Q?;s P.,rfl-, An, A^;
rt-ro-k..n A Electric -power from' the transmission net-cluding necessary instrumentati work to the onsite electric distribution sys-trols to maintain the unit in a ton and: -
tem shall be supplied by two physically inde-Ad during hot shutdown, and (2)
Safe condflW pendent circuits (not necessarily on separate te capability for subsequent cold sh]'
rights of way) designed and located so as to' the reactor through the use of suitabl minimize to. the extent practical the likeli-:
cedures.
hood of their simultaneous failure under op-'-
Applicants for and holders of constrt erating and postulated accident and environ-.,
permits and operating licenses undeti MC mental conditions. A switchyard common to part.who apply on or after January 10. 4 both circuits Is acceptable. Each of these cir-2 applicants for design certifications uz f
cults shall be designed to be available in suf-.,
part 52 of this chapter who apply On ori-flcient time following a loss of all onsite al-'
January 10. 1997, applicants for and holds4 V ternating current power supplies and the of combined licenses under part 52 of.@
t other offsite electric power-circuit,.to assure; chapter who do not reference a standard:^
that specified Aceptable:fuel dei iiiimits}; sign certification, or holders of operatieij and design conditions of the reactor coolant censes using an alternative source S pressure boundary are not exceeded. One of under 550.67, shall meet the requirement' these circuits shall be designed to be avail-this criterion, except that with regard able within a few seconds following a loss-of-control room access and occupancyjdis coolant accident to assure that core cooling, quate radiation protection shali be prpjdk containment integrity, and other vital safe-to ensure that radiation exposures shajijoF t tyfonctions are maintained.ar-.~trn-zo exceed 0.05 Sv (5 rem) total effectivb Ooe
/5DProvislons shall be Included tominimize z equivalent (TEDE) as defined In 550.2 forksj A-the probability of losing electric power from,' duration of the accident.
P.; any of the remaining supplies as a result of,':'
or coincident with, the loss of power gen--.,
II Protectfon and Reactivitp Control SySi9 erated by the nuclear power unit, the loss of Criterion 20-Protection system funcN6h.
power from the transmission network, or the:
The protection system shall be deslgned'-)
>-'.loss of power from the onsite electric power to iniate automatcally the operatipq.
suppiles.
appropriate systems including the reactiflij Criterion 18-Inspection and testing of electric control systems, to assure that specifie 'a.
- power systems. Electric power systems impor-ceptable fuel design limits are not exce0a tant to safety shall be designed to permit ap-as a result of anticipated operational &Uih' propriate periodic inspection and testing of rences and (2) to sense accident condfftiiW important areas and features, such as wiring, and to initiate the operation of systein-Insulation, connections, and switchboards, to components important to safety.
assess the continuity of the systems and the Criterion 21-Protection system reliability condition of their components. The systems testability. The protection system shalli' 5 shall be designed with a capability to test signed for high functional reliablity tIaw periodically (1) the operability and func-service testability commensurate ii,:ii tional performance of the components of the safety functions to be performed Ri5d, systems, such as onsIte power sources, re-dancy and Independence designed intIb lays, switches, and buses, and (2) the oper-protection system shall be sufflcient ability of the systems as a whole and, under sure that (1) no single failure results conditions as close to design as practical, the of the protection function and (2) r full operation sequence that brings the sys-from service of any component or cbl tems into operation, including operation Of does not result in loss of the requiri-P1s applicable portions of the protection system, imum redundancy unless the acceptablWOK and the transfer of power among the nuclear ability of operation of the protection power unit, the offsite power system, and the can be otherwise demonstrated. The iPr onsite power system.
t.on system shall be designed to per Criterion 19-Control room. A control room odic testing of Its functioning when the shall be provided from which actions can be tor Is In operation, including a capSblklj taken to operate the nuclear power unit safe-test channels independently to de ly under normal conditions and to maintain failures and losses of redundancy. thbat' It In a safe condition under accident condi-have occurred.
- tions, including loss-of-coolant accidents.
Criterion 22-Protection system indePlg' Adequate radiation protection shall be pro-The protection system shall be des vided to permit access and occupancy of the assure that the effects of na tIU1Y control room under accident conditions nomena, and of normal operatinS U--,
without personnel receiving radiation expo-nance, testing, and postulated ac "ye t
Bures in excess of 5 rem whole body, or Its ditions on redundant channels do not equivalent to any part of the body, for the in loss of the protection function, °r duration of the accident. Equipment at ap-demonstrated to be acceptable on so.1 propriate locations outside the control room defined basis. Design techniques 5,
shall be provided (1) with a design capability functional diversity or diversitig in" for prompt hot shutdown of the reactor, in-nent design and principles of OPe
.t
- used to the extent prac Pe of the protection functic Criterion 23-Protection syst Me protection system shal
'en into a safe state or in ontrated to be acceptable o:
4ned basis if conditions sui gion of the system, loss of e:
tic power, instrument air). i 7rerse environments (e.g.. e pld. fire, pressure, steam, jtion) are experienced.
Criterion 24-Separation o0 control systems. The protecti be separated from control sy Went that failure of any sin tern component or channel,
,noval from service of any s System component or chann, non to the control and prc leaves intact a system sat
,billty, redundancy, and i]
uirements of the protection connection of the protection tens shall be limited so as safety is not significantly im Criterion 25-Protection sys fOr reaCtivity control malfunct Utior system shall be designe specified acceptable fuel de Sot exceeded for any single the reactivity control syster rental withdrawal (not ejeci
.ot control rods.
, Criterion 26-Reactivity cont bdancy and capability. Two In
- rity control systems of -
principles shall be provided.
.tems shall use control rods
'cluding a positive means fR
.rods. and shall be capable of:
i.lg reactivity changes to a.<
conditions of normal operf Intlcipated operational oc
$lth appropriate margin fR ruch as stuck rods, specified I4esign limits are not excee; wactivtty control system sh:
Lrellably controlling the rat ranges resulting from p Louver changes (including xe.
iW3vre acceptable fuel desigi EZceeded. One of the system 4le of holding the reactor Oder cold conditions.
>-Criterion 27-Combined react 4o 0apability, The reactivi Z fO3s Shall be designed to h 9-Pabiity, In conjunction w.
, by the emergency core e reliably controlling reacti s Psre that under postulated and with appropriate n
,the capability to cool tI TUerlon 28-Reactivity lin M ty control systems shall I 820