ML042960598

Handwritten Note to Dwight USAR and GDC-17 Items on Offsite Power Requirement...

ML042960598
Person / Time
Site:	Palo Verde
Issue date:	10/08/2004
From:	- No Known Affiliation
To:	- No Known Affiliation, Office of Nuclear Reactor Regulation
References
FOIA/PA-2004-0307
Download: ML042960598 (13)

Text

1 1 J(&6 72 /

O5X4 6-2: c 2 C)/' 3 Pdart~ Q ) XcWea/7 7E 0A

/XA9 / 2 675/16 -/, c,---

4'e,

PVNGS UPDATED FSAR 8.2 OFFSITE POWER SYSTEM 8.

2.1 DESCRIPTION

The offsite power system consists of six physically independent circuits from the Arizona-New Mexico-California-Southern Nevada power grid to the PVNGS switchyard. Offsite power from the switchyard through three startup transformers and six intermediate buses is provided to supply two physically independent preferred power circuits to the ac power distribution system of each unit.

The offsite power system is described in this section and is depicted in figures 8.1-1 and 8.2-1.

8.2.1.1 Transmission Network The transmission system associated with PVNGS supplies offsite ac power at 525 kV for startup, normal operation, and safe shutdown of Units 1, 2, and 3. The six 525 kV lines of this system, PVNGS to RUDD, PVNGS to Westwing I, PVNGS to Westwing II, PVNGS to Kyrene, PVNGS to North Gila, and PVNGS to Devers, cover distances of approximately 37, 44, 44, 74, 114, and 235 miles, respectively.

All six transmission lines associated with PVNGS traverse relatively flat terrain and their design meets grade B requirements specified by the National Electrical Safety Code, sixth edition.

The Code specifies loading areas, wind loads for towers and conductors, and safety factors to be used. The conductors and the overhead ground wires are dampened to maintain acceptable levels of vibration. None of the 525 kV lines associated with PVNGS cross one another. There is a crossing of the Westwing I and Westwing II lines by 525 kV line not associated with PVNGS, approximately 43 miles from PVNGS.

June 2003 8.2-1 Revision 12 LDCR 02-F023

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM The six transmission lines associated with the PVNGS switch-yard, and their,rights-of-way, are designed so as to minimize line proximities that could result in simultaneous failure of more than one circuit. Based on historical transmission system data, the frequency of occurrence for breakage of the span of line that crosses the two Westwing and Westwing lines is 1.1 x 10-5 per year. In the highly unlikely event of grid instability resulting from simultaneous short-circuiting of both Westwing lines, a loss of all nonemergency AC power event could result. This design basis event is evaluated in chapter 15.

8.2.1.2 Switchyard and Connections to the Onsite Power System Prior to the construction of PVNGS there were no transmission lines to, or transmission switchyards in the vicinity of, the site.

Construction of PVNGS includes construction of a 525 kV switchyard of the breaker-and-a-half design in which three breakers are provided for every two terminations, either line or transformers. The switchyard is connected to the six 525 kV transmission lines associated with PVNGS, the 525/24 kV turbine-generator main transformers, and the 525/13.8 kV startup transformers, as shown in figure 8.2-2. These figures reflect the development of the switchyard as each unit is added.

Each turbine-generator connects to the switchyard through a main transformer, a 525 kV tie line, and two 525 kV switchyard breakers, as shown in figure 8.2-2. Physical connections between the units and the 525 kV switchyard are shown in figure 8.2-1.

June 2003 8.2-2 Revision 12 LDCR 02-F023

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM The three startup transformers connect to the switchyard through two 525 kV switchyard breakers each, and feed six 13.8 kV intermediate buses. These buses are arranged in three pairs, each pair feeding only one unit.

The intermediate buses for Units 1, 2, and 3 are inter-connected to the startup transformers so that each unit's buses can access all three startup transformers when all startup transformers are connected to the switchyard.

The intermediate buses are connected to the onsite power system by one 13.8 kV transmission line per bus (two per unit). These lines are physically separated to minimize the possibility of simultaneous failure of the lines.

8.2.1.2.1 Switchyard and Offsite Power System Development Figure 8.2-2 depicts the switchyard and 13.8 kV bus arrangements.

Necessary 525 kV breaker installation is accomplished during refueling, if possible, or during operation. All operating 525 kV positions are transferred to the opposite bus: thus, continuity of offsite power is maintained.

8.2.1.2.2 Water Reclamation Facility Load Shedding The Water Reclamation Facility loads are load shed from the Unit 1 intermediate buses upon a Unit 1 BOP ESFAS Mode 1 signal concurrent with switchyard voltage at or below a value which could result in a trip of offsite power in the event of a safe shutdown or emergency event.

June 2003 8. 2-3 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM 8.2.1.3 Compliance with Design Criteria and Standards The following analysis demonstrates compliance with General Design Criteria 17 and 18 of 10CFR50, Appendix A, and Regulatory Guide 1.32.

8.2.1.3.1 Criterion 17 -- Electric Power Systems In addition to the features detailed in paragraphs 8.2.1.1 and 8.2.1.2, compliance with Criterion 17 is further demonstrated by the following:

A. If one of the two 13.8 kV startup transmission lines per unit is interrupted, the remaining line can supply offsite power to both engineered safety features (ESF) buses, as shown in engineering drawing 01, 02, 03-E-MAA-002.

B. The two 13.8 kV transmission lines, supported on independent structures, are separated so as to avoid the possibility that the structural collapse of one will cause an outage of the other 13.8 kV line.

C. The 13.8 kV system is protected from lightning and switching surges by lightning protective equipment and by overhead static lines.

D. Design of the 125 V-dc system for the switchyards con-sists of two independent dc systems. Each of the two systems consist of a separate 125 V-dc battery, battery charger, and distribution system. Cable separation is maintained between the two systems. A single failure caused by a malfunction of either of the two 125 V-dc systems does not affect the performance of the other system. The ability of the switchyards to supply off-site power to the plant is not affected by the loss of one of the two 125 V-dc systems.

June 2003 8 :2-4 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM E. Two isolated 13.8 kV supplies from the intermediate 13.8 kV buses are provided to the switchyards. The ac load is divided between two power panels and loss of one feeder from the plant does not jeopardize con-tinued operation of the switchyard equipment.

F. For reliability and operating flexibility, the switch-.

yard design includes a breaker-and-a-half arrangement for each circuit along with breaker failure backup protection. Each breaker has two trip coils on separate, isolated dc control circuits. These pro-visions permit the following:

1. Any transmission line can be cleared under normal or fault conditions without affecting any other transmission line.

2. Any circuit breaker can be isolated for maintenance without interrupting the power or protection to any circuit (subject to'limitations of power system development paragraph 8.2.1.2.1).

3. Short circuits on a section of bus can be isolated without interrupting service to any circuit other than that connected to the faulty bus section.

G. The offsite sources from the 525 kV switchyards to the startup transformers are separate and independent. The failure or structural collapse of one system or structure does not affect other offsite sources.

H. The offsite sources from the startup transformers to the 13.8 kV switchgear located at the units are independently and separately routed.

I. Two physically independent circuits are provided for offsite power to the onsite distribution system for June 2003 S. 2-5 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM each unit; The offsite source normally connected to each ESF bus is immediately available to supply components important to safety following a postulated loss-of-coolant accident. Either of the two offsite sources to each ESF bus, if available, can be connected by control switch operation in the control room.

(subject to the limitations of power system development paragraph 8.2.1.2.1).

8.2.1.3.2 Criterion 18 -- Inspection and Testing of Electric Power Systems The 13.8 kV and 4.16 kV circuit breakers can be inspected, maintained, and tested on a routine basis. This can be accomplished without removing the generators, transformers, or transmission lines from service (subject to limitations of power system development paragraph 8.2.1.2.1).

Transmission line protective relays can be tested on a routine basis. This can be accomplished without removing the transmission lines from service. Generator, main transformer, and service transformer relays are tested on a routine basis when the generator is offline.

Onsite power components will be periodically inspected and maintained as required. This can be accomplished without removing the transmission lines, generators, or transformers from service.

8.2.1.3.3 Regulatory Guide 1.32 As described-in paragraph 8.2.1.3.1, listing I, an independent immediate access circuit is provided to each Class lE bus for each unit.

June 2003 B. 2-6 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM 8.2.1.3.4 Industry Standards The design complies with applicable standards and recommendations of:

• Institute of Electrical and Electronics Engineers, Inc.

(IEEE) National Electrical Manufacturer's Association (NEMA)

• National Electrical Code (NEC)

• American Society of Civil Engineers (ASCE)

• Underwriters' Laboratory, Inc. (UL)

• American Iron and Steel Institute (AISI) 8.2.2 ANALYSIS ThIe transmission system associated with PVNGS is planned so that the loss of a single transmission element (i.e., line or transformer) does not result in loss of load, transmission overload, undervoltage condition, or loss of system stability to the Arizona-New Mexico-California-Southern Nevada extra high voltage (EHV) grid. Offsite power supply reliability is determined by the performance of the six 525 kV supply circuits associated with PVNGS. The source stations for these circuits (RUDD Westwing, Kyrene, Miguel, and Devers) all have three or more connected circuits of 230 kV and above, which provide the appropriate reliability.

Power flow studies conducted for the described system indicate that the system can reliably deliver power to all project par-ticipants using the above planning criteria. Dynamic stability studies. have shown that the system can withstand the following disturbances without loss of system stability or loss of load:

June 2003 8.2-7 Revision 12 LDCR 02-F023

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM A. A permanent 3-phase fault on the switchyard 525 kV bus with subsequent loss of the critical 525 kV line.

B. A sudden loss of one of the three PVNGS units with no underfrequency load- shedding measures in effect.

C. The sudden loss of the largest single load on the Arizona-New Mexico-California-Southern Nevada system.

In withstanding these disturbances, which are used as design criteria, the system exhibits a very stable response, with significant positive damping achieved and with system frequency deviation held within acceptable limits. (Salt River Project letter to APS # SALT RIVER PROJECT 20020206, "Final Report for the 2002 Palo Verde / Hassayampa Operating Study",

2/6/2002). These results represent the response of the system associated with PVNGS with 7% generation stability margin.

Although these studies conclude that a PVNGS unit trip would not cause grid instability, certain chapter 15 accident analyses conservatively assume that offsite power is lost as a consequence of a PVNGS turbine trip. Refer to section 8.3.4 and table 15.0-0.

Grid availability data on EHV systems in the area indicate an outage rate of 2.08 total outages per year per 100 line miles.

Of these, 1.08 are due to planned outages and 1.00 are due to forced outages. Due to all causes, the outage ratio for 500 kV lines in the area is 0.00180.

On 230 kV systems in the area, similar data indicate outage rates of 6.59 total outages per year per 100 line miles. Of these, 2.97 are due to planned outages and 3.61 are due to forced outages. Due to all causes, the outage ratio for 230 kV lines in the area is 0.0394.

June 2003 8.2-8 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM These outages are mio1t commonly attributable to lightning.

Other causes are fog, contamination, flooding, other aspects of weather, falling objects, equipment failure, emergency maintenance, employee error, and, hypothetically, dust contamination. The chief constituents of dust storms are nonconducting clay dust (usually quartz) and conducting gypsum (calcium sulphate) which can contaminate the insulators. This contamination increases the probability of flashover, especially with fog or dew, by disclosing the salts to form an electrolyte.

However, dust buildup is reduced by the self-clearing action of the "VI' string insulator configuration used in EHV line construction and by the abrasive action of the dust and sand.

Also, any adverse conditions resulting from insulator contamination within the switchyard can be corrected by washing the insulators.

APS has never experienced a flashover in any of its EHV switchyards due strictly to dust on insulators and has found that dust storms contribute little to the outage frequency of EHV transmission lines.

Likewise, APS has not experienced any known dust-caused insulation failures at the 15 kV or 4 kV voltage levels in either open substation facilities or enclosed switchgear.

Therefore, it is felt that dust loading on the 13.8 kV system will not be a problem. The system is designed such that, with rare exceptions, forced outages do not result in loss of load.

Other forms of contamination that increase the probability of flashover in certain areas, especially near the Pacific coast, are sea-salt deposits and industrial contaminations. The insulators can become contaminated by the salt deposits and June 2003 B.2-9 Revision 12

PVNGS UPDATED FSAR OFFSITE POWER SYSTEM when fogging conditions exist, flashovers are more likely to occur.

To minimize the effect of both salt and industrial contamination, the insulators are washed with demineralized water. The frequency of washing depends on the area. Some areas near the Pacific Coast require washing once a month while areas farther inland require washing every 90 days. The use of semi-conducting glazed insulators also reduces the flashover rates in areas of high contamination. No washing of insulators is anticipated in the desert regions.

June 2003 8.2 -10 Revision 12

10 CFR Ch. I (l-1 ,. ission ir.RegulOtOrY Commlso Pt. 50, App. A AnticiPated operatinoanzc ated operational Occur crrences.t Lout the unit, particularly In loca-

• lations which can result in conditions ex-onditiOns Of normal oenceso nehnth -uch as the containment and control ceeding specified acceptable fuel design lim-ected to Occur One or snore times duhae re detection and fighting systems of its are not possible or can be reliably and fe of the nuclear Power unit adad piate capacity and capability shall be readily detected and suppressed.

re not limited to loss of piowe ndnlude l 1ed-and designed to minimize the ad- Criterion13-Instrumentationand control. In-slatlon pumps, tripping of erto the turba.ll Ir-4 effects of fires on structures, systems, strumentation shall be provided to monitor oatar set, isolation of th te ma rine C g Omponents important to safety. Fire- variables and systems over their anticipated Id loss of all offelte power. anCnex ngsystems shall be designed to assure ranges for normal operation, for anticipated their rupture or Inadvertent operation operational occurrences, and for accident CaRrET3A not significantly impair the safety ca- conditions as appropriate to assure adequate tg of these structures, systems, and safety, including those variables and systems

1. Overall Requirements that can affect the fission process, the Integ-

~T~erlon 1-QualitY- 3tandard, and  :. - vEntironmental and dynamic ef- rity of the reactor core, the reactor coolant ructures, Systems, and components imhsp /esign bases. Structures, systems, and pressure boundary, and the containment and at to safety shall be designed fab iY . prponents important to safety shall be de-

>gped to accommodate the effects of and to Its associated systems. Appropriate controls 3cted, and tested to qualityada shall be provided to maintain these variables nsurate with the Importance ftesft ompatible with the environmental condi-associated with. normal operation, and systems within prescribed operating IctiOns to be performed.Wee~ee 1 ranges.

Ognlzed codes and stands are aljtenance, testing, and postulated acci-1Y shall be identifled and evlutdode *pets including loss-of-coolant accidents. Criterion 14-Reactor coolantpressure bound-mine their applicabflity adeq tnd 'these structures, systems, and components ary. The reactor coolant pressure boundary TicIency and shall be supplemented or halU be appropriately protected against dy- shall be designed, fabricated, erected, and difled as necessary to assurea ult ZI jamic effects, Including the effects of mis- tested so as to have an extremely low prob-

,duct in keeping with the reuiedlaft siles, pipe whipping, and discharging fluids. ability of abnormal leakage, of rapidly prop-ctlon. A quality assurance Prog Shf that may result from equipment failures and agating failure, and or gross rupture.

from events and conditions outside the nu- Criterion 15-Reactor coolant system design.

established and Implemented in order to dear power unit. However, dynamic effects The reactor coolant system and associated vide adequate assurance that these struc- associated with postulated pipe ruptures In 5s. systems, and components wil satisfan_ auxiliary, control, and protection systems naclear power units may be excluded from shall be designed with sufficient margin to 1y Perform their afetyafunctbonsy Aqa pro the design basis when analyses reviewed and assure that the design conditions of the reac-teo records of the design, fabrication approved by the Commission demonstrate ftion. and testing of structures sye that the probability of fluid system piping tor coolant pressure boundary are not ex-componentimportant tp safety shall be rupture is extremely low under conditions ceeded during any condition of normal oper-ntained by or under the control Of the consistent with the design basis for the pip- ation, including anticipated operational oc-lear Power unit licensee throuigot the ing. currences.

of the unit. Criterion S-Sharing of structures, systems, Criterion 16-Containment design. Reactor iterion 2-Design bases for proteciona and components. Structures, systems, and containment and associated systems shall be na natural phenomena. Structures. sys- components Important to safety shall not be provided to establish an essentially leak-3, and components important to safety shared among nuclear power units unless it tight barrier against the uncontrolled re-I be designed to withstand the effects of can be shown that such sharing will not sig- lease of radioactivity to the environment xal phenomena such as earthquakes, tor- nificantly impair their ability to perform and to assure that the containment design

'es, hurricanes, floods, tsunaraj, and their safety functions, Including, in the conditions Important to safety are not ex-

'es without loss Of capability to perform event of an accident in one unit, an orderly ceeded for as long as postulated accident

• safety functions. 'he design bases for shutdown and cooldown of the remaining conditions require.

structures. systems. and Components units. Criterion 17-Electric power systems. An on-reflect: (1) Appropriate consideration of nost severe of .the natural phenomena Il. Protection by Multiple FissionProduct site electric power system and an offsIte have been historically reported for the Barriers electric power system shall be provided to and surrounding- area, with Sufficient permit functioning of structures, systems, Criterion 10-Reactor design. The reactor and components important to safety. The In for the limited accuracy, quantity, core and associated coolant, .control, and

>eriod of time in which the historical safety function for each system (assuming protection systems shall be designed with the other system is not functioning) shall be have been acctunulated. (2) appropriate appropriate margin to assure that specified Inatlons of the effects of normal and ane- to provide sufficient capacity and capability acceptable fuel design limits are not exceed-t conditions with the effects of the nat- ed daring any condition of normal operation, to assure that (1) specified acceptable fuel Phenomena and (3) the Importance of Including the effects of anticipated oper- design limits and design conditions of the re-

,fety functions to be performed. ational occurrences. actor coolant pressure boundary are not ex-

'ron3 -Fire Protection. Structures, syr- Criterion 11-Reactor inherent protection. ceeded as a result of anticipated operational and components important to safety The reactor core and associated coolant sys- occurrences and (2) the core is cooled and be dsiged nd lcatd t miimize, tems shall be designed so that in the.power containment integrity and other vital func-tentwit othr sfetyreqireents, operating range the net effect of the prompt tions are maintained in the event of postu-ubablit an efect f fresandexplo- inherent nuclear feedback characteristics lated accidents.

Noncmbutlbl an hea reistant tends to compensate for a rapid Increase In The onsite electric power supplies, includ-lalsshal beuse wheeve prctical reactivity. ing the batteries, and the onsite electric dis-Criterion12-Suppression of reactorpower os- tribution system, shall have sufficient Inde-ered in designing the system against a. cillatiots. The reactor core and associated pendence. redundancy, and testability to per-failure are under development. Coolant, control, and protection systems form their safety functions assuming a sin-shall be designed to assure that power oscil- gle failure.

19 A

Pt. An ADDr. A in i-ro &-kI o, .^ -_

P .,rfl-, An, A^; l Ad Ah ,. IMP* rt-ro-k . .n

• ~~~~-_W_,O Edi Q?;s ts 1.lt-0 ,clear Regulaltory Corr A Electric -power from' the transmission net- cluding necessary instrumentati work to the onsite electric distribution sys- trols to maintain the unit in a ton and: -

• used to the extent prac Pe of the protection functic tem shall be supplied by two physically inde- Adduring hot shutdown, and (2) Safe condflW Criterion 23-Protection syst pendent circuits (not necessarily on separate te capability for subsequent cold sh]' Me protection system shal rights of way) designed and located so as to' the reactor through the use of suitabl ' 'en into a safe state or in minimize to. the extent practical the likeli-: cedures. ontrated to be acceptable o:

hood of their simultaneous failure under op-'- Applicants for and holders of constrt erating and postulated accident and environ-., permits and operating licenses undeti MC 4ned basis if conditions sui gion of the system, loss of e:

mental conditions. A switchyard common to part .who apply on or after January 10. 4 tic power, instrument air). i both circuits Is acceptable. Each of these cir-2 applicants for design certifications uz 7rerse environments (e.g.. e f cults shall be designed to be available in suf-., part 52 of this chapter who apply On ori- pld. fire, pressure, steam, flcient time following a loss of all onsite al-' January 10. 1997, applicants for and holds4 jtion) are experienced.

V ternating current power supplies and the of combined licenses under part 52 of.@ Criterion 24-Separation o0 t other offsite electric power-circuit,.to assure; chapter who do not reference a standard:^ control systems. The protecti that specified Aceptable:fuel dei iiiimits}; sign certification, or holders of operatieij be separated from control sy and design conditions of the reactor coolant censes using an alternative source S Went that failure of any sin pressure boundary are not exceeded. One of under 550.67, shall meet the requirement' tern component or channel, these circuits shall be designed to be avail- this criterion, except that with regard ,noval from service of any s able within a few seconds following a loss-of- control room access and occupancyjdis System component or chann, coolant accident to assure that core cooling, quate radiation protection shali be prpjdk non to the control and prc containment integrity, and other vital safe- to ensure that radiation exposures shajijoFt leaves intact a system sat tyfonctions are maintained.ar-.~trn-zo exceed 0.05 Sv (5 rem) total effectivb Ooe ,billty, redundancy, and i]

/5DProvislons shall be Included tominimize z equivalent (TEDE) as defined In 550.2 forksj uirements of the protection A- the probability of losing electric power from,' duration of the accident.

• connection of the protection P.; any of the remaining supplies as a result of,':' tens shall be limited so as or coincident with, the loss of power gen--., II Protectfon and Reactivitp Control SySi9 safety is not significantly im erated by the nuclear power unit, the loss of Criterion 20-Protection system funcN6h. Criterion 25-Protection sys power from the transmission network, or the: The protection system shall be deslgned'-) fOr reaCtivity control malfunct

>-'.loss of power from the onsite electric power to iniate automatcally the operatipq. Utior system shall be designe suppiles. - appropriate systems including the reactiflij specified acceptable fuel de Criterion18-Inspection and testing of electric control systems, to assure that specifie 'a. Sot exceeded for any single

- power systems. Electric power systems impor- ceptable fuel design limits are not exce0a the reactivity control syster tant to safety shall be designed to permit ap- as a result of anticipated operational &Uih' rental withdrawal (not ejeci propriate periodic inspection and testing of rences and (2) to sense accident condfftiiW .ot control rods.

, Criterion 26-Reactivity cont important areas and features, such as wiring, and to initiate the operation of systein-Insulation, connections, and switchboards, to components important to safety. bdancy and capability. Two In assess the continuity of the systems and the Criterion21-Protection system reliability  ;*rity control systems of -

condition of their components. The systems testability. The protection system shalli' 5 principles shall be provided.

shall be designed with a capability to test signed for high functional reliablity tIaw .tems shall use control rods periodically (1) the operability and func- service testability commensurate ii,:ii 'cluding a positive means fR tional performance of the components of the safety functions to be performed Ri5d, .rods. and shall be capable of:

systems, such as onsIte power sources, re- dancy and Independence designed intIb i.lg reactivity changes to a.<

lays, switches, and buses, and (2) the oper- protection system shall be sufflcient , conditions of normal operf ability of the systems as a whole and, under sure that (1) no single failure results Intlcipated operational oc conditions as close to design as practical, the of the protection function and (2) r $lth appropriate margin fR full operation sequence that brings the sys- from service of any component or cbl ruch as stuck rods, specified I4esign limits are not excee; tems into operation, including operation Of does not result in loss of the requiri-P1s applicable portions of the protection system, imum redundancy unless the acceptablWOK wactivtty control system sh:

and the transfer of power among the nuclear ability of operation of the protection Lrellably controlling the rat power unit, the offsite power system, and the can be otherwise demonstrated. The iPr rangesresulting from p Louver changes (including xe.

onsite power system. t.on system shall be designed to per iW3vre acceptable fuel desigi Criterion 19-Control room. A control room odic testing of Its functioning when the shall be provided from which actions can be tor Is In operation, including a capSblklj EZceeded. One of the system taken to operate the nuclear power unit safe- test channels independently to de 4le of holding the reactor ly under normal conditions and to maintain failures and losses of redundancy. thbat' Oder cold conditions.

>-Criterion 27-Combined react It In a safe condition under accident condi- have occurred.

tions, including loss-of-coolant accidents. Criterion22-Protection system indePlg' 4o 0apability, The reactivi Adequate radiation protection shall be pro- The protection system shall be des Z fO3s Shall be designed to h vided to permit access and occupancy of the assure that the effects of natIU1Y 9-Pabiity, In conjunction w.

, by the emergency core control room under accident conditions nomena, and of normal operatinS U--,

without personnel receiving radiation expo- nance, testing, and postulated ac "ye t e reliably controlling reacti Bures in excess of 5 rem whole body, or Its ditions on redundant channels do not s Psre that under postulated equivalent to any part of the body, for the in loss of the protection function, °r and with appropriate n duration of the accident. Equipment at ap- demonstrated to be acceptable on5 so.1 ,the capability to cool tI propriate locations outside the control room defined basis. Design techniques, shall be provided (1) with a design capability functional diversity or diversitig in" TUerlon 2 8-Reactivity lin Mty control systems shall I for prompt hot shutdown of the reactor, in- nent design and principles of OPe .t 820