ML13317A516
| ML13317A516 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 02/10/1983 |
| From: | Paulson W Office of Nuclear Reactor Regulation |
| To: | Dietch R Southern California Edison Co |
| References | |
| TAC-62079, TASK-07-01.A, TASK-7-1.A, TASK-RR LSO5-83-02-014, LSO5-83-2-14, NUDOCS 8302230400 | |
| Download: ML13317A516 (18) | |
Text
February 10, 1983
-ocket No. 50-206 LS05-83-02-014 Mr. R. Dietch, Vice President Nuclear Engineering and Operations Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800.
Rosemead, California. 91770
Dear Mr. Dietch:
SUBJECT:
SEP TOPIC VII-1.A, ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS, INCLUDING QUALIFICATION OF ISOLATION DEVICES SAN ONOFRE NUCLEAR GENERATING STATION, UNIT 1 The enclosed final Technical Evaluation Report has been prepared by the staff to reflect the comments provided in letters from R. W. Krieger to D. M. Crutchfield dated January 20, 1983 and February 7, 1983.
As result of our-review, the staff concludes that our previous safety evaluation remains unchanged and recommends that-the present isolation schemes be justified or' that additional isolators be provided.
The need to actually implement these changes will be determined during the integrated safety assessment. This topic assessment may be revited in the future if-your facility design is changed or if NRC criteria relating to this topic are modified before the integrated assessment is completed.
Sincerely, Walter A. Paulson, Project Manager6. SJE/
Operating Reactors Branch No. 5 Division of Licensing
Enclosure:
As stated cc w/enclosure:
See next page 8302230400 830210 PDR ADOCK 05000206 P
PDR S E P SEPB..
SEPB.
SEPB
_ IOR ORB!
OFFICEO.........
W eo..
.n..n
- b1 EMcKenn CGrimes W
l WPaulson DCru..
Tield SURNAME:
SP us......#
DATE4 2/
/83 2//83 2/.
/83 2/9 /83 2 /
2/12/83 j_/83 NRC FORM 318 (10-80) NRCM 0240 OFFICIAL RECORD COPY USGPO: 1981-335-960
Mr. R. Dietch, Vice Present iDocket No. 50-206 Nuclear Engineering and Operations San Onofre 1 Southern California Edison Company 2244 Walnut Grove Avenue Post Office Box 800 Rosemead, California 91770 cc Charles R. Kocher, Assistant General Counsel James Beoletto, Esquire Southern California Edison Company Post Office Box 800 Rosemead, California 91770 David R. Pigott Orrick, Herrington & Sutcliffe 600 Montgomery Street San Francisco, California 94111 Harry B. Stoehr San Diego Gas & Electric Company Post Office Box 1831 San Diego, California 92112 Resident Inspector/ San Onofre NPS c/o U.S. Nuclear Regulatory Commission Post Office Box 4329 San Clemente, California 92672 Mayor City of San Clemente San Clemente, California 92672 Chairman Board of Supervisors County of San Diego San Diego, California 92101 California Department of Health ATTN: Chief, Environmental Radiation Control Unit Radiological Health Section 714 P Street, Room 498 Sacramento, California 95814 U.S. Environmental Protection Agency Region IX Office ATTN:
Regional Radiation Representative 215 Freemont Street San Francisco, California 94111 Robert H. Engelken, Regional Administrator U.S. Nuclear Regulatory Commission, Region V 1450 Maria Lane Walnut Creek, California 94596
0519JR SEP TECHNICAL EVALUATION TOPIC VII-1.A ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS SAN ONOFRE Docket No. 50-206 February 1983 Final 2-1-83
-CONTENTS
1.0 INTRODUCTION
2.0 CRITERIA........................
1 3.0 DISCUSSION AND EVALUATION..........................
2 3.1 Discussion.....................................
2 3.1.1 Pressurizer Pressure...........
3 3.1.2 Pressurizer Level..........................
.4 3.1.3 SteamtoFeedwaterFlowMismatch.
6 3.1.4 Loss of Reactor Coolant Flow..................
6 3.1.5 Reactor Coolant Pump Breakers...................
7 3.1.6 Turbine Trip.....................................7 3.1.7 StartupRate ReactorProtection.o 8
3.1.8 High Flux Level.............................
3.1.9 Manual Reactor Trip...........................10 3.1.10 Safety Injection Reactor Trip..................
10 4.0
SUMMARY
10
5.0 REFERENCES
11 APPENDIX A--NRC SAFETY TOPICS RELATED TO THIS REPORT...............
13 11
SEP TECHNICAL EVALUATION TOPIC VII-1.A ISOLATION OF REACTOR PROTECTION SYSTEM FROM NON-SAFETY SYSTEMS SAN ONOFRE
1.0 INTRODUCTION
The objective of this review is to determine if non-safety systems which are electrically connected to the Reactor Protection System (RPS) are properly isolated from the RPS and if the isolation devices or techniques used meet current licensing criteria. The qualification of safety-related equipment is not within the scope of this review.
Non-safety systems generally receive control signals from RPS sensor current loops. The non-safety circuits are required to have isolation devices to ensure electrical independence of the RPS channels. Operating experience has shown that some of the earlier isolation devices or arrange ments at operating plants may not meet current licensing criteria.
2.0 CRITERIA General Design Criterion 24 (GDC 24), entitled, "Separation of Protec tion and Control Systems," requires that:
The protection system shall be separated from control sys tems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems, leaves intact a system that satisfies all reliability, redundancy, and independence requirements of the protection system. Inter connection of the protection and control systems shall be limited s as to assure that safety is not significantly.
impaired.?
IEEE-Standard 279-1971, entitled, "Criteria for Protection Systems for Nuclear Power Generating Stations," Section 4.7.2, states:
1
The transmission of signals from protection system equip ment for control system use shall be through isolation devices which shall be classified as part of the protection system and shall meet all therequirements of this docu ment. No credible failure at the output of an isolation device shall prevent the associated protection system chan nel from meeting the minimum performance requirements speci fied in the design bases.
Examples of credible failures include short circuits, open circuits, grounds, and the application of the maximum cred ible AC or DC potential. A failure in an isolation device is evaluated in the same manne as a failure of other equip ment in the protection system.
3.0 DISCUSSION AND EVALUATION 15 3.1 Discussion. The Reactor Protection System (RPS) includes the sensors, amplifiers, logic, and other equipment essential to the monitoring of selected nuclear power plant conditions. It must reliably effect a rapid shutdown of the reactor if any one or a combination of parameters deviates beyond preselected values to mitigate the consequences of a postu lated design basis event.
The RPS parameters and their logic channels as identified in the San Onofre FSAR3 and updated in a letter Haynes to Ziemann4 are as follows:
Parameter Trip Logic High Pressurizer Pressure 2 out of'3 Variable Low Pressurizer Pressure 2 out of 3 High Pressurizer Level 2 out of 3 Steam To Feedwater Flow Mismatch 2 out of 3 Loss of Reactor Coolant Flow 2 out of 3*
Reactor Coolant Pump Breaker Open 2 out of 3*
-2outof3 Startup Rate Reactor Protection lout of 2 High Flux Level 2out of-4 Manual Reactor Trip lout of 2 Safety Injection Reactor Trip 1 out of 2
- Below 10% full reactor power, reactor trip is blocked. Reactor power from 10% to 50%, 2 out of 3 logic (Permissive 7); above 50% reactor power, trip logic is 1 out of 3 (Permissive 8).
2
3.1.1 Pressurizer Pressure.5 Three separate identical pres surizer pressure RPS channels are Used for the high pressurizer pressure reactor trip and for the variable low -pressurizer pressure reactor trip.
Pressure transmitters PT430, PT431 and PT432 each feed separate current loops. Each current loop includes the following:
- a. Power supplies fed from the 118V regulated power source.
- b. Repeater module, Foxboro model M/66-BR-OH, with an output signal to the pressurizer control system.
- c. Duplex bistable module, Foxboro model M/63S BR-OEHA, which includes inputs for the high pressure setpoint, the variable low pressure setpoint as modified by reactor coolant temperature and an output to the variable low pressure reactor trip relay(s) 430FX, 431DX, and 432BX.
- d. Test panel.
- e. Duplex bistable module, Foxboro model M/63S BR-OEHA, with an out put to the safety injection system.
- f. Bistable module, Foxboro model M/63S AR-CAHA, with an output to tne high pressurizer pressure reactor trip relay(s) 430K-X, 431H-X and 432E-X.
- g.
100 ohm shunt for the recorder signal.
- h. Pressure indicating meter.
There are two pressurizer control channels. Selector switch P/432 permits selecting repeater output signals from any; two of the three RPS monitor channels to operate the pressurizer pressure control system,
-associated annunciators and alarms.
3
Selector switch PR/430 perMits selecting any one of the three RPS chan nels for recording high pressure scram setpoint, variable low pressure scram setpoint and pressurizer pressure from the 100 ohm shunt on the current loop on a three pen recorder.
Contacts from the reactor trip relays 430FX, 431DX and 4328X are arranged in three groupsof 2-out-of-3 logic. They will trip the scram breaker A shunt trip coil, scram breaker B shunt trip coil and reactor breaker undervoltage coils in both breakers A and 8, any one of which will scram the reactor. Auxiliary contacts on the scram relays provide signals to the annunciators and the event recorder.
Manual switches in the scram relay circuits permit testing of indivi dual channels. Power for the three channels is provided from regulated power supplies I, II and III fed from vital bases 1, 2 and 3. The regu lated power supplies are isolated by fuses.
Evaluation. Foxboro Repeater Module M/66-BR-OH provides adequate isolation of the RPS from the pressurizer control system. Relay contacts provide necessary isolation of the RPS circuits from annuciators and the event recorder.
There is no isolation between the RPS circuit and the remote meter and the process recorder.
3.1.2 Pressurizer Level. 6 Three separate identical pressurizer level channels are used to monitor high pressurizer level.
Level transmit ters LT430, LT431 and LT432 each feed a separate current loop. Each current loop includes the following signal conditioning equipment.
- a. Power supply fed from the 118V regulated source.
- b. Repeater module, Foxboro model M/66 BR-OH, with an output signal to the pressurizer level control system.
4
- c. Duplex bistable modul.e, Foxboro Model M/63S BR-OOHA, with an output signal to the pressurizer level reactor trip relay(s)
- d. Test panel.
- e. A 100 ohm shunt for recorder signal.
- f. Level indicating meter.
There are two.level control channels. Selector switch L/432 provides selection of the repeater module output signals from any two of the three RPS monitor channels to operateethe level control systems.
Selector switch LR-430 permits selection of any one of the three RPS pressurizer level channels for recording the level setpoint ana pressurizer level on a two pen recorder.
Contacts from the reactor level trip relays 430A-X, 431A-X and 432A-X are arranged in three groups of 2-out-of-3 logic.
They will trip the reac tor trip breaker A shunt trip coil, reactor trip breaker B shunt trip coil B and undervoltage trip coils on both breakers A and B, any one of which will scram the reactor. Auxiliary contacts on the scram relays provide signals to the annunciators and the event recorder.
Manual switches in the scram relay circuit permit testing of individual trip circuits.
Power for the three channels is provided from regulated power supplies I, II and III.
These are fed from vital buses 1, 2 and 3. The regulated power supplies are isolated by fuses.
Evaluation. Foxboro Repeater Module M/66-BR-OH provides adequate isolation of the RPS circuitry from the pressurizer level control system.
Relay contacts provide necessary isolation of the RPS circuits from
annunciators and the event recorder. There is no isolation between the RPS circuits and the remote meter and the process recorder.
3.1.3 Steam to Feedwater Flow Mismatch.7,15 Signals from three independent steam flow monitors FT460, FT461 and FT462 and three independent feedwater flow monitors FT456, FT457 and FT458 are fed into three comparator bi'stables, FM456, FM457B and FM458B, respectively. The output of the com parators is a ratto of feedwater flow and steam flow which is further com pared to predetermined setpoints. Output signals exceeding the setpotnts will de-energize the output relays FM456B-X, FM457B-X and FM458B-X. Con tacts of the output relays are arranged in three groups of 2-out-of-3 logic which will trip the reactor trip breakers shunt coils A and B and the undervoltage trip coils A and B, any one of which will scram the reactor.
The steam and feedwater flow sensor also transmits a signal directly to the Optimac computer which operates the level control system for the three steam generators by controlling the feedwater flow. the same input signals for the steam generator control are also transmitted to process recorders YR456, YR457, YR458 and an I'action pak" that initiates annunciator actions.
Each channel is separately fused; however, the source of power could not be determined from available drawings.
Evaluation. The feedwater flow signals and the steam flow signals used to monitor the steam generator status and initiate a scram upon flow mi'smatch also provide signals to the steam generator flow and level con trols without isolation between the systems.
No isolation is provided between the flow signals and the process recorders and the action pak.
The qualification of the action pak as an isolation device has not been determined.
8,15 3.1.4 Loss of Reactor Coolant Flow.
Three independent and identical channels monitor the coolant flow rate. Flow transmitters FT400, FT410 and FT420 measure differential pressure in the hot leg of each cool ant loop providing the input signals for each ofthe three current loops.
Each current loop is supplied by a separate power supply and transmits a signal imput to a bistable module and a flow indicator. Outputs from the 6
bistables de-energize scram relays FC100-X, FC110-X and FC120-X whenever the flow signal is below the fl6w'setpoint. Relay contacts from the scram relays are arranged to initiate a reactor trip from a 2-out-of-3 logic when reactor power and the coolant flow output is greater than 10% but less than 50% full power. Above 50% full power and coolant flow > 85% the logic for the reactor trip changes to 1-out-of-3.
The reactor coolant flow protection system is similar in design to the pressurizer and pressurizer level protection systems.
Evaluation. The loss of reactor coolant flow protection system is not isolated from the remote meters and process recorders. Other non-safety systems are isolated adequately.
3.1.5 Reactor Coolant Pump Breakers.8 As a backup for loss of reactor coolant flow, auxiliary contacts on the reactor coolant pump breakers llAOl, 11A03 and 11B03 are arranged to initiate reactor trip upon opening of 2-out-of-3 pump breakers when power is between 10% and 50% full power, and 1-out-of-3 pump breakers when reactor power is above 50% full power.
Inputs to the event recorder and annunciators are from contacts on the breaker control auxiliary relay 152X.
Evaluation. The reactor coolant pump breaker scram circuit is adequately isolated from control and non-safety systems.
3.1.6 Turbine Trip.
Three pressure switches monitor the turbine governor oil pressures. Pressure switches PS63-1/AST, PS63-2/AST and PS63-3/AST open below 40 psig oil pressure de-energizing relays 63X-1, 63X-2 and 63X-3. Contacts of these relays are arranged in a 2-out-of-3 logic in the reactor trip circuit to initiate reaCtor scram.
Auxiliary relays 634-1, 634-2 and 634-3 provide inputs to the control systems. The contacts of the auxiliary relays also provide input to the annunciators and the event recorder.
7
Evaluation. The turbine trip reactor trip circuitry is adequately isolated from control and non-safety functions.
3.1.7 Startup Rate Reactor Protection.
5,16 Reactor Startup rate is monitored by two overlapping nuclear instrument systems. The source range system measures the initial neutron source strength to allow for safe plant startup and the intermediate range monitors overlaps the upper range of the source range instruments and monitors flux strength through the power range.
Two source range neutron detectors, N1201 and N1202, sense thermal neutrons. Outputs from each detector.are transmitted through separate signal conditioning systems to the period amplifiers. The period amplifier feeds a bistable which, upon sensing a rate of change greater than the pre scribed setpoint, turns off the bistable, de-energizing the output relay, and initiates rod withdrawal block. The two systems operate in a 1-out-of-2 logic mode. Other source range outputs include indicators for high count rate, high startup rate (SUR), rod stop, coincident high SUR rod stop, audio count rate, evacuation horns, recorders and data logger. All output sig nals, except the data logger and the recorders, are from relay contacts.
Recorders and data loggers use SUR analog signals without isolation from the SUR signal conditioning equipment.
The intermediate range neutron monitors, like the source range, con sist of two independent channels arranged in a 1-out-of-2 logic. Compen sated ion chambers NE1205B and NE1207B provide signals to the signal conditioning equipment, which drive relay drivers and output relays. A high startup rate will cause the relay drivers to acutate either a rod block relay or reactor trip relay. Outputs from these relays go to the coincidentor logic unit which proviaes a 1-out-of-2 signal fo-rod block or reactor scram. The coincidentor logic system is comprised of relay logic".
The two channels are redundant and isolated from Pach other.
Other outputs from the intermediate range nuclear instrumentation include signals to local and remote indicators, a recorder and the data logger. Annunciation and the event recorder are fed from the coincidentor 8
logic. Power to the monitor systems is protected by fuses in each channel.
The source of power could not be *determined from the information available.
Evaluation. There is no indication of isolation between the analog signals of the source range or intermediate range monitor circuitry and the recorders and data logger. THe annunciators and the event recorder are isolated from the RPS circuits by relay contacts.
3.1.8 High Flux Level. 11 15, High reactor flux level is monitored by four independent power range channels. Two ionization chamber outputs
- per channel are summed through a resistor network to provide the flux level input signals to the level amplifier. The system uses six uncompensated ion chambers plus the two compensated ion chambers from the intermediate range monitor channels.
The summed signals are transmitted to a level amplifier which outputs a linear DC signal which drives bistables and relay drivers. Output relay acutation includes overpower reactor trip, power level for permissive 7 logic, power level for permissive 8 logic, drop rod/rod stop and overpower rod stop. The logic is derived in the coincidentor module by relay matrix acutation. Other outputs from the coincidentor include annunciation, alarms and event recorder signals.
Other input and output functions of the power range system include the te'st and calibrate circuitry, output signals to two dual pen recorders, alarm and annuciator signals, a switch for selecting low, mid or high power ranges and a comparator channel. The comparator receives analog signals from the four power range channels and compares the four analog signal levels with one another.
It provides annunciation when any two channels deviate from one another by a preset amount and annunciates channel fail ures. Power to the signal conditioning circuits is from the 120V AC bus.
Each channel is separately fused.
Evaluation. The four power.range channels are separate and independent from each other. Logic signals fed to and through the coincidentor circui try are isolated by relay contacts. There is no indication of isolation of 9
analog signals to the control board mounted power level inaicators, the process recorders or the data logger.
3.1.9 Manual Reactor Trip.1 2 Two three-pole pushbutton switches are used in a 1-out-of-2 logic for manual scram. Switches 1/SPB1 and 1/SPB2 have their contacts directly in the reactor scram logic circui try. Each switch will trip scram circuit breaker trip coil A, circuit breaker trip coil B and undervoltage trip coils A and B.
Evaluation. The manual scram pushbutton circuitry is aaequately iso
- lated from control and non-safety functions.
3.1.10 Safety Injection Reactor Trip.13 Safety injection reactor trip is initiated by either of two sequencer logic units. Each sequencer outputs two safety injection initation and/or loss of power sig nals (subcbannels X and Y).
Reactor tr-.p requires either a safety injec tion signal or a loss of power signal from both subchannels of either sequencer to initiate reactor scram. Scram output signals are by relay contacts in the reactor protection system scram logic.
Sequencer #1 trip contacts actuate scram breaker B shunt trip coil and sequencer #2 actuates scram breaker A shunt trip coil.
Relay contacts from either sequencer actuate the uncervoltage trip coil for both A ana B scram breakers.
Status indication and annunciation is from separate logic outputs from the sequencer.
Evaluation. The safety injection reactor trip circuitry is adequately isolated from other functions in the sequencers and from control and non-safety systems.
4.0
SUMMARY
Based on current licensing criteria and review guidelines, San Onofre Nuclear Generating Station Unit 1 complies with all the current licensing criteria listed in Section II of this report, except for the.following:
10
.. ~-.-..
- 1. There is no isolation between the remote meters, the process recorders and the follbwing RPS circuits:a Pressurizer Pressure System Pressurizer Level System Steam to Feedwater Flow Mismatch System Startup Rate Neutron Monitor Systems High Flux Level System
- 2. There is no isolation between the data logger and the nuclear instrument systems.
- 3. There is no isolation between the steam to feedwater flow mis match system and Optimac computer which controls steam generator flow and level.
5.0 REFERENCES
- 1. General Design Criterion 24, "Separation of Protection and Control Systems," of Appendix A, "General Design Criteria of Nuclear Power Plants," 10 CFR Part 50, "Domestic Licensing of Production and Utili zation Facilities."
- 2. IEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations."
- 3. San Onofre Nuclear Generating Station-Unit 1, Part II-"Final Safety Analysis, Volume IV."
- 4. J. G. Haynes ltr to D. L. Ziemann, Docket 50-206, Systematic Evalua tion Program, San Onofre Nuclear Generating Station-Unit 1, dated August 9, 1979.
- 5. SONGS 1 Elementary Diagrams, 63716, Rev. 2 and 5112259, Rev. 4.
- 6. SONGS 1 Elementary Diagrams, 63717, Rev. 2 and 5112259, Rev. 4.
- 7. Westinghouse Drawings 495088, Rev. C, 495090, Rev..C and 4950911, Rev. B, SONGS 1 Elementary Diagram 5112259, Rev. 4.
a,.
Reference 6 states these instruments are considered safety-related.
Howev r, if the instruments have not been qualified as class lE equip
- ment, isolation buffers are required.
~11
- 8.
SONGS 1 Elementary Diagrams, 63714, Rev. 2, 5150335, Rev. 1 and 5112259, Rev. 4.
- 9.
SONGS 1 Elementary Diagrams, N-1541, Sheet 2, Rev. 15 and 5112259, Rev. 4.
- 10.
SONGS 1 Schematic Diagram 5150877, Rev. 2, 5150878, Rev. 2, 5151505, Rev. 2, 5151506, Rev. 2 and 5151507, Rev. 2.
- 11.
SONGS 1 Schematic Diagrams 51508883, Rev. 2, 5151505, Rev. 2, 5151506, Rev. 2, and 5151507, Rev. 2.
- 12.
SONGS 1 Schematic Diagram 5112259, Rev. 4.
- 13.
SONGS 1 Logic Diagram 5149180, Rev. 7.
- 14.
U.S. Atomic Energy Commission Regulatory Guide 1.89, "Qualification of Class 1E equipment for Nuclear Power Plants."
- 15.
R. W. Krieger letter to D. M. Crutchfield, Docket No. 50-206, Systematic Evaluation Program, San Onofre Nuclear Generating Station Unit 1, dated January 20, 1983.
- 16.
R. W. Krieger letter to D. M. Crutchfield, Docket No. 50-206, Systematic Evaluation Program Topic VII-l.A, San Onofre Nuclear Generating Station, Unit 1, dated February 7, 1983.
12
- 8.
SONGS 1 Elementary Diagrams, 63714, Rev. 2,.5150335, Rev. 1 and 5112259, Rev. 4.
- 9.
SONGS 1 Elementary Diagrams, N-1541, Sheet 2, Rev. 15 and 5112259, Rev. 4.
- 10.
SONGS 1 Schematic Diagram 5150877, Rev. 2, 5150878, Rev. 2, 5151505, Rev. 2, 5151506, Rev. 2 and 5151507, Rev. 2.
- 11.
SONGS 1 Schematic Diagrams 51508883, Rev. 2, 5151505, Rev. 2, 5151506, Rev. 2, and 5151507, Rev. 2.
- 12.
SONGS 1 Schematic Diagram 5112259, Rev. 4.
- 13.
SONGS 1 Logic Diagram 5149180, Rev. 7.
- 14.
U.S. Atomic Energy Commission Regulatory Guide 1.89, "Qualification of Cl.ass 1E equipment for Nuclear Power Plants."
- 15.
R. W. Krieger letter to D. M. Crutchfield, Docket No. 50-206, Systematic Evaluation Program, San Onofre Nuclear Generating Station Unit 1, dated January 20, 1983.
- 16.
R. W. Krieger letter to D. M. Crutchfield, Docket No. 50-206, Systematic Evaluation Program Topic VII-1.A, San Onofre Nuclear Generating Station, Unit 1, dated February 7, 1983.
12
AOPENDIX A NRC SAFETY TOPICS RELATED TO THIS REPORT
- 1. III-I Classification of Structures, Components and Systems.
- 2. VI-10.A Testing of Reactor Trip Systems and Engineered Safety Features, Including Response Time Testing.
- 3. VII-2 ESF System Control Logic and Design.
- 4. VII-3 Systems Required for Safe Shutdown.
13