to halt the reactor operation. Hie shutdown system is composed of many trip circuits which enable the system to actuate the emergency reactor shutdown system automatically, if the abnormal conditions such as reactor over loading and abnormal load increasing are detected.

To protect the reactor core and the containment vessel boundary under the accident conditions, together with automatic shutdown system of the reactor, the operating system of the engineered safeguard systems automatically actuates the safeguard systems such as the ECCS, isolation valves of the containment vessel and so on.

The reactor safety protection system consists of redundant channels designed to keep integrity of safety protection functions when assuming a single failure or a single removal of channels for test and maintenance during reactor operation. In addition, redundancy prevents any system malfunction caused by a false signal. Different logic matrixes such as “two-out-of-three” *^l, "two-out-of-four” and two-fold “one-out-of-two“ are used to satisfy the above requirements. As thoroughly as practically possible, the channels are physically and electrically independent from each other and, each of them has its own cable tray and instrument board rack. In addition, the protection system is designed with “fail-safe” philosophy, so that in the event of a loss of power or disconnection of system, either the protection system is actuated or a safe state is finally established.

The reactor safety protection system is independent of reactor control system. Therefore, if failures such as a short circuit or disconnection occurs in the reactor control system circuits, spurious signals do not reach the actuators of the safety protection system. Moreover, the design also provides regular tests of measurement channels and logical circuits trains during reactor operation.

The main control room accommodates all kinds of indicators, recorders, monitoring systems and control-handling systems which are required for normal and shutdown operation of the reactor system as well as for accident management operations, in order to be able to centrally manage the whole plant under any conditions. Also, the main control room design has provisions to prevent operators from exposure to radiation under the

accident conditions.

To minimize the possibility of a fire catch in the main control room and its immediate surrounding area, in principle, the structural materials of the control panel, main cables and other components are chosen from nonflammable, fire-resistant materials and sufficient fire prevention measures are taken.

4. Other Systems

In addition to the above mentioned design features of NPPs, care is taken to provide sufficient safety functions against the postulated most severe natural phenomena to occur in the plant environment to prevent a possible accident from being triggered. For example,'the design of a PWR plant must have sufficient earthquake-resisting features. In an earthquake-proof design, all the systems are classified into groups on the basis of their safety importance and the level of their earthquake-proof design is determined according to this importance.

Moreover, the radiation exposure of the general public living around the plant must be sufficiently low, i.e., an “effective dose equivalent" less than 50pSv per year, which is much lower than the value of ICRP recommendation of ImSv per year, is the goal of design and operation management efforts of the present plants in Japan.

* In the “one-out-of-two” logic matrix, if one of the two detection systems is actuated, it is considered that the corresponding event has occurred. In the two-foid “one- out-of- two" logic matrix, only when both of the “one-out-of- two" logic matrices are actuated, the corresponding event is considered to have occurred.

In “ two-out-of-three" or “two-out-of-four" logic, if two of three (or four) detection systems are actuated, the corresponding event is considered to have occurred. Both of these logic matrices have the characteristics of preventing spurious malfunctions of detection systems and acting only if they are certainly necessary.

NSRA, Japan