ML19319A859

Safety Evaluation of Instrumentation,Controls & Power Sys

ML19319A859
Person / Time
Site:	Oconee
Issue date:	08/03/1967
From:	US ATOMIC ENERGY COMMISSION (AEC)
To:
Shared Package
ML19319A858	List: ML19319A857 ML19319A859
References
NUDOCS 7912190992
Download: ML19319A859 (11)

Text

-

,4 4.

v 5

-heet i Sr@ int on Ins tr.,-

nt a t ion, Cenevols, and I' cur Ceone 1. nits 1, ? L 3

!n.'-

..-*-t e ien i Centrol hactor protection system - The. reactor protaccion system monitors vital reacter 9aram2ters and autor:ncicc11y trips the reactor when predetermined

- ecnditio'na established'for each_param2ter have been exceeded. These paramators and conditJons'are listed b31cw:

' a) The reactor pcuer, as reasured by neutron flux, reaches an established

' maximum limit, or th'e limit set by reactor coolant ficw.

b) The startup rata reaches an established maximum li:::it.

c)

Cartain mismatch conditions exist b2 tween reactor coolant flew and the. number of pump motor breakars in service.

d) Oh2 reactor outlet temperature reaches an established =axt::um limit.

c) The reactor pressure reaches an established minimum limit.

f) The reactor pressure reaches an established maximum limit.

The syst2m consists of four identical and independant protection channels, u ch t2rminating in a bistable and trip : lay.

Each of the aforementioned parametars, with the 2::c2ption of "Startup hte" is conitored by four acht nals uhich are coincident -and radundant. The output of each channel af a w aitored parameter respectively concrois one of the fcur logic-f.tann21s. Tha outputs of the lo;;ic channel trip relays are combined in

-a two-cut-of-fcur (2/4) logic configuration to operate four circuit breakers which-da-:nsrgize the two a.c. input circuits feeding the rod drive-(d.c.)

pcuer supplies. The circuit breaker logic is 1/2 X 2:

1.e., a trip results

~

if -(at'laast) one of the tuo circuit breakers in one a.c. -line and (at least) one in:the other lina'are opened.

Each a.c. lina furnishes pcwor to one of ths clutch _pcwer supplies.- Diodes at the d.c. outputs permit tasting of the

, final trip circuits during reactor operation.

Tha nuclear instrumentation has aight channels of Lneutron information divided into three ranges of -sensitivity:

scurce range, intermediate range,.and pcuer rat.ge.-(The three ranges-combine to give a continuous 100 m

y

..~ -,,

A

^

. b 1,

. maturem nt of racctor power from scurce level to approximate 1[1257. of

-full pcwcr,(or tan dacsdes of infcrmation. A minimum of one dccade of overla, ping 'inforration' is provided. The physical location of the neutron

detectors is'shcwn in Figure 7-10 (P 22),

^

~he sedres range instrumentation channels consist of two redundant count

. rate - channels, each using proportional counters as sensors. ~hese channels are :nce associated with a protection function; heuever, they do provide an -interlock function (a control rod withdrawal hold and alarm on high

.startup rate).

-The ~intermediats range instrus2ntation has two. log N channels each using

-identical-ga:ma-compensated ion chambers as sensors.

• teactor trip initiation is.provided by these channels.

~The pcwer rangs-instrum2ntation censists of four linear level channels

.using twelve (three por channal) uncoepensated icn chambers.

~he gain a!' 2ach channel is adjustabic, providing a ceans for calibrating the cutput against a reactor heat balance. Protective action consists of reactor trip initiation at preset flux levels.

Primary Icop; fica information is raasured as a function of pressure drop by four-indapendent sensors in each ecolant icop. The outputs of the cight sensors are combin2d as pairs such that'four independent toen1 flev signals are darived.

Iach total-ficw signal is fed to ens of the four

.pcwer range channels, thus-creating fcur independent pcuer/ flow channels.

In addition, 'each pump otor breaker has four contacts which are respect-ively connected to the four.pcwer/ flow channels.

Each channell receives

. ident ical ' informat ion.

The pcwer/ficw channels will initiate reactor.. trip if:

.a) reactor pcuer anceeds 1077. full power (F.P.) under any conditicns, c;

.b).

the pouer/ flow ratio exceeds 1.07 under any conditions, or

• d)t -'cne pu=p1is lost as a result of a tripped: pump motor breaker when operating above1a predetermined neutron pcwer icvel (X7. F.P.), or

~

(... -,

• Anticipatory trip ~ _

s T.

S

}

r wnn n y

i p

if

. d&

a

^

=

t

.a.

- 3'-'

L*d): cne pucp is: lost.for. reasons other than tripping of its breaker (e.g.,. a. sheared rotor) when operating above X7. F.?., or e) two (or core) pumps are Icst as a result of tripped pump motor

. breakers, and the ratio of reacter pcwor to the steady state 31cw corrssponding to the remaining pumps is greater than 1.07.

da automatic servo action, calling for a reduction in pcwer to achieve a prcper power /ficw racio, will. occur when pcwor is. belcw X*'. 7.P., and

.a) -.one pump is lost due to tripping of its breakar, or-b) mora'than~ one pump is lost dus to breaker tripping and the ratio

'of reactor power (at the instant of breaker trip) to the steady state ficw correspondin3 to the recaining pumps is less than 1.07.

The abcve provisions allow the dcwnward adjustment of reactor pcuer to a icvel commensurata with the retaining pumps as a means of "kaeping ahead" of.the flow coastdown unlass it is a for23cne conclusion (as

" judged" by tha'various comparator circuits) that the impending loss-of-

' flow transient islsufficiently severe to uarrant immediate trip.

The' ic31c of the pcwer/ flow channals is' 2/4, and the channals are ind2nndently connected to tha reactor protection system logic channels

'-.ia.tha same manner as-the pcuer ran32 channels.

.There is ona set of four pressure censors and cna set of fcur temperature sensors which respectivaly trip tha r2 actor on high and low primary system

~

p assura, and high coolant outlet tamperatura.

~he lo31c is 2/4, and the

-instrument channals' arc independently conn:cted to the four logic channels

_in the sa:M ranner as the pouar range channels.

Cne pressure channel also Jprovides a. signal to the pressurizer pr2ssura centro 11er.

""ce other three chann213 will prcvida trip.-action on a redundant basis should a failure

. disabic.the:one connon channel and si.tultaneously initiets a pressure transient.

The ' nuclear and' process. instruzant c: innels, by virtue of being redundant, can. withstand any. singic failura without loss of protective function. The-coincid-ant logic permits tasting during reactor operation.. In addition, all-instrumant-channals _ initiate a. trip signal (fail safe) in the event of ca.c. voltage l'oss.

Control'.and sofety functions are ec=bined within indi-vidual instru=ent channels-only to the extent a11 cued ay critaria governing itha'dasign cf reactor protection.systaes.

y

• Anticipatory trips.

g y

,a ;.e(-'.

[tmb $ 3.:4N m

m_

hi' 1

m j;

7 v.

e

',f, c-g v

e t

(;

f s

t.

~

1 4_

3 t

h

.The ;four lo31c 'channola have been analyzed and found to be " fail safe" lin :he ' event of voltage loss,.imnune to single failures, and testable L

lor cradible faults. The "fa'il safety" is inherent since the channels cre _trippad~ uhan"da-energised. A partially. or. completely _ failed channal 9111 disabic cnly~ one relay. Action of the thrac~ remaining channels will

~

- cpen cil fcuricircuit. breakers at the clutch power supplies. Action of onlyitvo of the ' remaining channels is actually required,and they will cp; n at least one. circuit breaker at each power supply.. Faults within a: 1ccic:channal will be. revealed when :he bypassed, contacts do not trip

.their rclay when tested.. Cpen circuits l ara self-rsvealing.

Short circuits between channals can be datectad by tripping tha "high pressure". contacts ene' at a time' (these are' the contacts located furthest upstream).

Cur analysis of tha final-trip circuits shcus that they are foil safa, 1:=une to single failura, and ttstable. The loss of cne breaker in each a.c. 'line can be' tolerated.' Dicdc failure, open or shorted, will not prevent trip acticn. A " hot" short at chs positive d.c. line will have no cifact sine:2Lthe d.c. system'is ungrounded.

The system will be equipped with ground-fault datectors. Loss of a.c. and/or d.c. will causs, or

. tend to:cause, reactor trip. Tasting at pcwer is accc=plished by tripping the circuit. breakers. one at a ti=2 and noting the absence of -d.c. voltage ist the appropriate pcuer supply cutput just upstream of its isolating diode.

The cunual trip switch contacts arc -in series with the four circuit

. breaker ~undervoltage coils. Th re is no dependence on instrumentation.

.Thd ;incoralinstrumentation' systcc provides no automatic centrol or protective function. The-system is located entirely within containment, thereby precluding.the need fer isolaticn of penetrations associnted with

-ths sys:cm.

'The t ongin23rsd safety f 2atures protacticn syscam automatically performs the ic11 cuing functicns to mitigate the. 2f fects ' f a sericus accident:

o a): Initiates operation ci.the cora emergency injection system upcn.

. detection of' low reactor ecolan: prassure.

. b)l: Initiates? operation ^of tha raacter building cooling systems upon

- da:2ction cf-an abncreally high reactor building.prassure.

c) i!niciatas containment isolation upon'dctaction of an abnorn: ally high'reactorbuildingsprassure.

y 1 4 i

a w

w g

4 %-_

Q{

.p

--?

... s m

y

.,5 i

d). Initiates isciaticn of linesuhich are directly open to the

?.cactor'_ building,on a hich radiation' signal.

live : sits of pressure sensin; channels initiate the ena,ineered safety; features. hch set is coincident and redundant (2/3 logic).

17wc act.respectively initiate.the high and icw pressure coolant injection syste=s. These channels operate through a=plifiers and ubistabla devices and are fail safe in terms of. voltage loss.. Two cther sets of three channels actuate. the reactor _ building spray system.

In these channela, pecasure suitches are operated directly; there is no dupendence on ciectrical-pcuer for switch operation. The remaining set of p: essure sensor channels initiates; reactor building ecergency cooling

- and.containcent isolation.'

Centacts' controlled by these channels are respectively ccabined into pairs' of redundant logic chains which, in turn, control the safety feature systems. This.is shcwn in Figure 7-2, ?SAR. These chains are

'::at951e at pescr by = cans of tvo lights wired across the contacts.of iach chain such r. hat the tripping of a channel produces a unique response from-its lights.

Isch-redundant logic chain is energized from an independent d.c. pcuer source.

Should a power source be Icst, the dcwnstream circuits fail "as is".

'Je believe. that, with the system redundancy provided, this condition is acceptable..

The an3 necrnd safety-features instrument channals do not centrol the 1

paraecters which they measure; i.e., ther. is' separation of control and

~

na!ety..

'anual actuation capability, ' independent of the instrucent channels, is

.providad.

E 4n --iv ny' control.

P.esetivity.Lcentrol is maintained by movable control rods and by soluble poi $cn (bcric' acid) dissolved in.the reactor cociant.

Thei control' rod' drives are ;being designed in accordance with detailed Ecriterla which5can be; su=marized as fo11 cast

. Sing 1'e failures" shall be limited to one drive.

a)

-t b). ~~No ' single: failure; shall cause ' the uncontrolled withdrawal of any

~

• t

rod.

4

^

f; e

JA Ahu j'e f

1 L

+

c

p H-r

r s

A

~ c): Yo moreLthan' two contro1 > groups co'n be withdrawn at one time.

. d)' The withdrawj speed shall be limited so as not to. exceed 25 percent cverspeed in.the ~ event of speed control fault.

e) -Ocn'tinuousspo'sition indication shall be provided.

WeL agree with these. criteria, and have performed safety analysis to determine the Lproposed system's degree of cenformity to these criteria:

~

In order to determine the worst effect of "singic _ failures"'which might

~

~

not 'be confined to a single rod drive, we asked the applicant to perf. m

~

- "atortup accident"- analyses covering the entire spectrum.of initial p eer levels. This accident assumes the uncontrolled simultaneous withdrawal of all reds'-(not already in.the fully withdrawn. position) at caximum design speed, and further assumes _that the excursion is terminated only by Copplerifeedback and, trip action of the power range nuclear channels.

The applicant' cencluded:

"No fuel damage would result frca simultaneous

.all-rod withdrawal from any initial pcwer level."

? rom the preceding, we 'have concluded that a single failure which allowed

'an extra rod group to be withdrawn, a situation less severe than the a ccident analyzed, would not cause fuel damage.

There will. be - two " speed limiting" features.- Cn is the pulser (or clock) which will' be designed not to onceed a certain maximum frequency. The

-cther is a:" Speed saturating circuit" dcunstream of the pulscr which has the tinherent property of not responding to a frequency greater than 1257.

.cf' rated frequency.

1There are two independent analog red-position sensors at each rod drive, a actenticester cnd a ' linear variable differential t ansformer (L7DT).

~

Thbr3 'ars two _ indeps_. 3nt. limit switchas.

In' addition, the LVOTs will alco acnerata limit signals. Thus, there are redundant analog and limit position indicating' systems at each rod.

Zach analog signal at a rod

-- can be. fed into the individual rod positica indicator.

dase'd on. our analysis', we believe' that. the applicant's criteria conform

. to our..own,.that _ no' singic failure can produce an excursion which will V

breach the protection

system, and that the proposed rod drive designs-

~

c can be nbuilt.in _accordance wich'these criteria.

~

~

^

~

U iu..m

,m i1 a

,m

ra s 3

g h-s,

U m

1

_ g s

.7.-

3

' 2cactivityi is:also controlled by a permiss'ive system which allows. anual dilution of L the ' primary system coolant-boron concentration when a particular-p

' <=

control' rod group.reachas the fully'withdraun position.. Dilution is auto-

=atically-. terminated when the rod group, driven dcun-.by the servo, reaches s prescribed' position,-or when the -integrated dilution flow has reached a

. preset raximum. le understand that these circuits will be designed in accordance with protection systiem standards.

D*Je agree with the implied criterion that'no single tailure should prevenc q

Lautomaticitermination Loi dilution, when required..

InLsucrary,lwe conclude that the' applicant?s design Oriteria' relating to'instru= ntation and controls are satisfactory and that the proposed-preliminary designs conform to these criteria.

7 e*n Description

?.ach.rasetor unitL uill generate electric power 'at 19 kv which uill be

~ fed through an isolated phase bus to a unit step-up transformer where it will-bs raised to 230 kv for Units 1 and 2, and 500- kv for Unit-3.

Two~ 230 kv overhead transmission lines will carry power between Units 1 dad 2 andL thef station switchyard which will be connected to the. existing Duke 230 kv: transmission line. 7 tom Unit: 3, an overhead tra smission 1_ine will; carry power between thi station and.the switchyard which will be connacted to Duke's 500 kv transmission network. An autocransformer

-uill. tie together the,230 and 300 kv systems at the station switchyard.

In addition, a separate 100 kv._line will be run directly from the gas-turbine' generating staticn at 1.ee.

. 2ach : unit will have' its cwn 60 W.V startup transformer. The 100 kv line will :tarminate in a_ transformer at Cconee which will serve all three.

nits,e as required.:

% :-ally, cach unit will supply.-its o9n auxiliary loads directly from-

the ; generator via che station auxiliary transformer.

Since each unit in,bainsidasigned to-accept'a 1C0% load rejaction, the primary source-ccf goweri for the 'auxiliaryf oods in the event of -system blackcut will-l

32.;the Lunitisenarators themselves. -In the event.of a unit trip, the

~

s f;:cuer 'cources will' be autoratically switchad onto the auxiliary busses 4

'in the: preferential! sequency as follows:

n

.L

^

w t

V A

i 97L w.

.i 2 v

?

p;m -

r y'

A, e %

4;g 4,

, a 1

s, 4

5-

~

5

?a)L Lehe dtartup transformr bus-(includes the Kocuee Station 230 kv 11n'2 )

E S):

the other. units' auxiliary electrical system (subsequent to the Jcemp_letionicf Unit 2)

.c).

the 100 kv transmission.line from Lee d) the Keewee Ilydro Station 13.3 hv line.

The 2 cosie Iiydro Statien will be located approximately ena-half mile from

~

the station switchyard, and will cennist of tuo 70 Ele generating units.

Tach unit is essantially, independent of the other and is prcvided with its

cun'startup equipment located within separate cubicles within the.*cowee

. centrol-rcom. ~-The initiation' of startup is accomplished by control si3nals

?rm the Ccence control room areas.- Formal startup of either unit is by ep;r.ator 2cticn whila c=cr3ency startup is automa:ic. 3cth units are

tarted automatically and sicultan cusly cn either of two conditions:

if

. tha external, transmission systam is lost or if en31neered safeguards actica la required.

2ither hydro.can be-connected to either of two lines feeding the Cconee Ita:1cn.' Cne is an overhead 230 hv lina to the station switchyard; the other is an undarground 13.3 kv lina run directly to a 10 XVA transformer.

7 cur 103 v.d.c. batteries and. sin battery chargers will be supplied for Unit-1.

dna pair of batteries and one s2t of three chargers will feed

-cn2 230/125 volt bus, and tha remaining pair of ' batteries and set of chargers will fsed a redundant 2f0/125 volt bus (Ref. Fig. 8-3, PSAR).

Upon completion of Unit 2, this. d.c. system will se ve both units. A 1 third three-uire. system will; be. installad upon completion of Unit 3.

_ 10 itching: circuits will permit any' d.c. system to serve any unit.

~ Initially,- there.will.be'six~ 125 v.d.c. distribution panels, each of which willl receive -d.c. power free bcch three-wire d.c. sources through isolating dicdes. -Two more panels 9111 be -installed with Unit 3 and will

~

beisimilarly pcwered. ~ Four vita 11 instrument busses (single phase) will Lbo provided !cr Units 1 and 2,.and:uill-be independently energized from

' tatic'~invertars cennected to.one cf the six d.c. distribution panela.

L Tuo ecre vital-instrucent busses will be added with Unit 3.

These will befpowered.1. through statie: inverters, frcm the two additional d.c. panels.

c da addition,7there will:be" three single phase 120 v.a.c. regulated instru-Lont1bussas.z ?hese 6111 normally b2 connected to the 600.v.a.c. busses of-

~

theirj oen unitsithrought regulating: equipment.. Provision will be made to 7, witch overSto the vita 1 L instrument busses, tif necessef.

7 y

}.

?

r s_

Ma a

A h

^

y

+

vm sw 6:2 s

_-__ _ - u __

u EE

.f z

s s

.y

, 7,7 mb

~:

m 9-

+

k

'J 7.nalpcia

7; en c'ompletion'of Un'it 1, off-site pcuer will be available from the 100 kv ayst W and frca the 220 kv system whi~ch feed power into Oconee over separate s transmicaion lines from Jocasse and Central. An additional'230 kv tie to

'"13er uill bs installed upon completion of Unit 2; and, upon completion of Unit 3,. a'tio to Duke's 500 kv system will be installed. All off-site lines will beisnergized from several pcner 32nerating stations, and the Duke

~

. system isidesigned to. withstand the stsp-loss of any single generating unit j

withinL its network.-

Ridunc'antitransformers.will be available to distribute pcwer to engineered safety feature leads. A startup transformer from the 230 kv system and a separate transformer from the.,100 kv system will be installed with Unit 1.

An additional startupitransformer will be installed with each of the other Ltvo units as;they ara completed, and sach transformer will be able to

- 2nergi e the emergency loads of.any unit.

In vic4 of the foregoing, we agreed uith tha applicant that the proposed

'off-site pcicr sources and associated distribution equipment are sufficiently

aliable for the intended purpose.

z li.e.innot, howevar, datermina' that these collective off-site sources are

'ic-ane to the adverse offects of single failures. Recent blackout experience alscuhera sug3csts that such i=: unity may not exist. Accordingly, and inas-r.uch 'ar the. desi3n and ~ utilization of the.on-site power scurces are under the c direct: control of the applicant, we have-analyzed the proposed on-site pcuer system on the1 basic that the sin 31a failure. criterion must be met.

Upcn loss of the external. grid, redundant voltage and frequency sensing devices on each of thel 230 kv switching station busses will initiate, c-through separata and redundant channels, tripping of all 230 kv switching

atation isc15 tion brsakers,1 closing of all 230 kv switching station pcuer l_

1sspply breakers and startup of bcch Kecuce units. They will synchronize and be connected to the 230 kv lines.

One unit will also feed the 13.3 kv 16nder3rcund;11ne. Shedding of ncn-essential loads(a requirement because (cCtheL1.imitad cap'acitylof the 13.S kv/4.16 kv transformer) will' be accom-Lplishe'diby, circuit breakers with duplicate trip coils ener3ized from different

-A d.c. bu3scs.

s

Upcn-loss oF ha. external grid and thef tripping of a given Oconee unit' r

"(causs~d/foriexample,.by' afloss of ~ coolant l accident) the emergency pcuer t.ccurces yill; befautomatically switched onto the emergency (4.16 kv) bus'ses -

1 1_-

ofxthifaff actad: unit in. the icquence stated pravicusly..

c.

i.

'~

l' c

+

r

'~g%

~m h~_>

x

[-

,l~

](

~

5

'.' 1

-i.

".-1 E

..e 4

x

-.a-ejm~

+ 7p[,'

s W i-52 '

~, ' ~

X.

y;.

y

~

g., x

' E, s,

h-

• y p

e

,l s

.i V

- 1C -

[.;O '

V m

~ iCur7analysisf indicatesithat -thsyaquencing system is essential to plant

- W

~

-Lsafsty;since ?its failure -could Icave' thA cmergency. busses with no'_ power.

.c Mic have been assured.that-this System will. =ce: the single failure criterion.

...k'.'

b~

y

' mae:Keowee' hydro units Lean pick up emergency leads f rom dead start -in

3 seconds,~uhichiis adequateLunder design basis accident (CEA) conditions.

Elf tripped offjline fat fu113 power Tdue to a system disturbance, each unit

[

. cah pick upffull'1 cad inLseven seconds. : Each unit's voltage regulator is feguipped iith,a vol's-per-cycle limiting feature which permits.it to accept t

losd at theioutsett and thus drag-the loads up to. full speed in synchronism 7

uith ~its; cwn acceleration. This serves to reduce the. time' required-for the-initiation of safeguards sys't'em action. 'de concur with the applicant that

?

'iti is"a' desirable. feature. '

EThe-hydro plant?is started by opening gates which are pcuered by hydraulic accu ulators.

3tored hydraulic' energy is sufficient for three full opening a.ud cicsing cycles.; Centrol circuits for omr3ency actuation of the accuru-lators will befredundant.- A shear pin arrangecent within; the mechanical sportioniof the gate drive vill release a ja=med or other-wise fouled gate from'ths others..

iThe1 protection system cn the' hydro plant will be limited to only these parameters that vill prevent gtneration of pcuer, such as generator insulaticn breakdoun or icss of' field.

In ;the event;both1 hydro units cust be chut down briefly for caintenance, amer;ency pcuer can be made.vailabic to Ccenee via the 100 kv line which can be isolated frcm the rest of the grid and kept continuously energized -

E by_ onf of = the I.ce ststion gas turbine ;;enerators set aside exclusively for ll Lthis 1,urpcse. 'Je believe this =crits consideraticn even though it would allow at temporary non-redundant source of.emar;cncy pcwor. We will'at

[

' theioperating license stage assure that; the integrated pcuer syster.is,

~ iatludin; the-reacter units,' will. provide reliable power for accidant n

{

ccndi: ions.-

t h

~hlangineered safety. feature auxiliaries are provided with redundancy.

To esintain;this redundancy, the ~ applicant.has. stated that these auxiliarles

.uilixhejconnected:to redundant busses such that safety. feature : auxiliaries 7

performing thefsame function are connected to different busses.

Each of e

fth e. busses 1isisupplied frem the radundant-4160 volt' main feeder busses-f/,

~

-uhichiare,;in turn :supplice frcm the redundant.' sources. described previously.

I de concur with' the : applicant.inithis -design apprcach since it is an effective p:

7andVsi=ple'_vayNf l implementing:the' single failure criterion (2ef. Fig. 8-1,

( PS.d) O

j_

[

c Mn b.: '

D**

D PMr 9

t

&}

O p.l y'

' ' W i

g

~

~'

D-.

- q' '

' d: :

+

j

.j..

j %,,

.b

%;p w

q.,

3 s

E.,

s I

~

- -'-11:.

E e:ri.favidQ: cf lt$e station battery system indicates that-itL is' redundant c nd bestabic. !Nolta;2'at eachfoflthe~pancl-boards is derived from re--

~

a 3g A:ndant! sources-feeding l throughfisolation ' diodes such that failure of l

cnc. scurcrdocs not affect;the voltage at the -panel board bus. : Loss of 7g,

Lvoltaspatia?pancl;b'oard bus:will not negate the d.c. system function.

4 i

Cur. review also'. indicates that no single-failure. cant cause a : loss of -

ivoltage atiall~ vital instrumentibusses.

f5

^

Magree with3the applicant?s. critasia relating to the design of:the

~

on-sice +energency :pcuci1systers, and' believe: that the system can..b'e

- builtli~n conformity with'these criteria.

s R

)

t-'

r

-i k

5

+O c

?

I

~ '

' M I_

j/ '

c >

.?.

(:_W.

_' i _

l n

~

rA easums a

s.

>y, s

~

,