The design of the control system is such that a malfunction which leads
to an abnormal withdrawal rate of the rods will not result in a
dangerous condition. Studies indicate that the minimum reactor period
resulting from maximum withdrawal of the rods is not less than 30
seconds. The control system is designed to maintain the _net_ reactivity
insertion always less than the delayed neutron fraction.
The entire reactor system is protected by the safety system. This system
causes the reactor to terminate power production if a dangerous
operating condition exists. The safety system also contains interlocks
which prevent actions which would otherwise jeopardize the reactor
system.
The control and safety systems are capable of protecting the reactor
system from damage due to any credible accident except a major leak in
the primary loop.
The reactor will “scram” (shut down) automatically from any of seven
causes: (1) shorter than a safe reactor period, (2) excessive power, (3)
excessive rise or fall in reactor pressure, (4) excessive reactor outlet
pressure, (5) loss of flow, (6) loss of power to safety circuits, and
(7) loss of power to control rod drives.